Edit tour

Windows Analysis Report
Document 101-116.pdf

Overview

General Information

Sample name:	Document 101-116.pdf
Analysis ID:	1643500
MD5:	09fcd457a331137b2891ac2913680ddb
SHA1:	12a0d6a2f1bce37eb214f83c6697d2de54c28bfd
SHA256:	a057ba83208be579940254b56ce402625d88c669fee1e4ca93085565dee1f37a
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Found potential malicious PDF (bad image similarity)

AI detected landing page (webpage, office document or email)

Suspicious PDF detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Document 101-116.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7804 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8116 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1596 --field-trial-handle=1592,i,56940659623526008,9426062706914596360,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 2072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://storage.googleapis.com/dlbrautigan/index.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3032 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2024,i,12779079142382512444,18033674228529783655,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2280 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: Page contains button: 'VIEW SECURE DOCUMENT' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'view secure document'

Suspicious PDF detected (based on various text indicators)

Source: Adobe Acrobat PDF

OCR Text: New Document Received New File Received! PDF You've received (3) new PDF Documents for your review Please click the "View Secure Document" link below and sign in using your email account credentials to view it. VIEW SECURE DOCUMENT

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.195
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.148
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.24.148
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCIrgzgEIruTOAQiL5c4BSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: Document 101-116.pdf	String found in binary or memory: https://storage.googleapis.com/dlbrautigan/index.html)

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Document 101-116.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1596 --field-trial-handle=1592,i,56940659623526008,9426062706914596360,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://storage.googleapis.com/dlbrautigan/index.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2024,i,12779079142382512444,18033674228529783655,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2280 /prefetch:3
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1596 --field-trial-handle=1592,i,56940659623526008,9426062706914596360,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2024,i,12779079142382512444,18033674228529783655,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2280 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Document 101-116.pdf	Initial sample: PDF keyword /JS count = 0
Source: Document 101-116.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9suo4ip_1c60yce_5y0.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9suo4ip_1c60yce_5y0.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
e8652.dscx.akamaiedge.net	23.39.37.95	true	false	high
www.google.com	142.251.40.164	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.251.40.164	www.google.com	United States		15169	GOOGLEUS	false
23.39.37.95	e8652.dscx.akamaiedge.net	United States		16625	AKAMAI-ASUS	false

IP
192.168.2.4
192.168.2.13
192.168.2.23

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1643500
Start date and time:	2025-03-19 21:40:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Document 101-116.pdf
Detection:	MAL
Classification:	mal56.phis.winPDF@40/48@3/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	driver1.exe	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	bpypadkyksfdjjjs.exe	Get hash	malicious	Quasar	Browse	199.232.214.172
	bopwadthjjawds.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	mrwipe12312.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	mrwipe12312.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	VM Transcript Caller Left (2) CALL-MSG (010758Secs) 0dca046e198529fd52f5c8ffd061f84a.msg	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://u1.tweeddisparity.shop	Get hash	malicious	Unknown	Browse	199.232.210.172
	SecuriteInfo.com.Win64.CrypterX-gen.8376.19365.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	http://thetollroads.com-z1m5.cyou	Get hash	malicious	Unknown	Browse	199.232.214.172
	fattura_AR00881673_pdf.vbs	Get hash	malicious	GuLoader	Browse	199.232.210.172
e8652.dscx.akamaiedge.net	processed-ach-remittance-031925 (2).pdf	Get hash	malicious	Unknown	Browse	2.19.105.127
	DTG.pdf	Get hash	malicious	Unknown	Browse	72.246.169.163
	Munsch-Employee-Handbook.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.209.209.135
	doc Pg 2A gmt_5057363908.pdf	Get hash	malicious	HTMLPhisher	Browse	23.192.153.142
	Yasmine Hilal W2, 401(k).pdf	Get hash	malicious	Unknown	Browse	23.192.153.142
	virus.pdf	Get hash	malicious	HTMLPhisher	Browse	92.123.21.129
	Emarine System Contact Update.pdf	Get hash	malicious	HTMLPhisher	Browse	2.19.105.127
	1099-NEC.pdf	Get hash	malicious	RHADAMANTHYS	Browse	23.209.213.129
	1099-NEC.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	resume.pdf	Get hash	malicious	Unknown	Browse	23.209.213.129

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	otohjsejdwear.exe	Get hash	malicious	LummaC Stealer	Browse	23.204.10.89
	jkse.mips.elf	Get hash	malicious	Unknown	Browse	72.246.93.122
	mrwipe12312.exe	Get hash	malicious	LummaC Stealer	Browse	23.204.10.89
	jkse.ppc.elf	Get hash	malicious	Unknown	Browse	173.223.114.164
	m68k.elf	Get hash	malicious	Unknown	Browse	23.36.238.98
	jklspc.elf	Get hash	malicious	Unknown	Browse	96.16.0.162
	Message.eml	Get hash	malicious	Unknown	Browse	2.19.122.209
	nklsh4.elf	Get hash	malicious	Unknown	Browse	23.59.229.152
	splsh4.elf	Get hash	malicious	Unknown	Browse	23.57.24.58
	splx86.elf	Get hash	malicious	Unknown	Browse	2.19.26.87

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.181963598381839
Encrypted:	false
SSDEEP:	6:iOG5eIq2Pwkn2nKuAl9OmbnIFUto5CBZmwC5CbkwOwkn2nKuAl9OmbjLJ:7G5eIvYfHAahFUto5CB/C5Cb5JfHAaSJ
MD5:	C7F70E1D881C70C897AD4E3915187241
SHA1:	283A94A22C029C8442638F7F0DB886A66CCF23C2
SHA-256:	C2237BE6AB6D2E0EAA2694B5DB25BEA9254C4083FC443699A0507FFEC0AA5EEB
SHA-512:	441B34BFE59734A6E76BD0AD88DD1968435610C8826912C08E9E87D966BC3CCB83A56581054E70584739AA7DEC2F895036189D2A1D3961B2EBA6F37A4F5E38FF
Malicious:	false
Reputation:	low
Preview:	2025/03/19-16:41:01.233 1eb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/19-16:41:01.235 1eb0 Recovering log #3.2025/03/19-16:41:01.235 1eb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6413)
Category:	downloaded
Size (bytes):	6418
Entropy (8bit):	5.7894975388106005
Encrypted:	false
SSDEEP:	192:Yo6rMvuOa8AU9mUSW+/H6666rpoR+BcorwQ1v1Gr:Y/MrA/USW0H6666rp7ccwWMr
MD5:	FF569B29BFC6BC121D223F8BEDB644E1
SHA1:	68EF38B2563B23E9C063245032B280583AF33691
SHA-256:	92CA01C41A8001CEBCD18E107E8D0C55E4CAC8A48F85EC172E930B3AA6641198
SHA-512:	441A5BFBD0A95670DDA4CF3E466A9211CB3433A3214103C66355B4D87EFBF5253F0D0A47659F3AAF37330E4317C9B7B89AC4E5F6CEAF69C761C50A4CD1F731DD
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
Preview:	)]}'.["",["san francisco 49ers","nike sb air jordan 4 navy","apple iphone 17 pro max","southwest airlines","spacex nasa astronauts","southwest airlines checked bags","mlb dodgers cubs","assassin creed shadows"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChoIkk4SFQoRVHJlbmRpbmcgc2VhcmNoZXMoCg\u003d\u003d","google:suggestdetail":[{"google:entityinfo":"CggvbS8wNnJueRINRm9vdGJhbGwgdGVhbTLKDWRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFBbUNBTUFBQUJER20yckFBQUE5bEJNVkVYLy8vK3FBQUFBQUFDdEFBQ3lBQUQ3Ky90MUFBQ21BQUJoQUFCOUFBRG41K2ZaMmRtM28yTzBuMkYzZlgyN3BHU3NyS3lTQUFDSEFBQ2RBQUMxbTE2dVdUWmhZV0h4OGZIZjM5K2pvNk5tWERpelhqa2VIaDZTa3BKckFBQldWbFo4YWtCWUFBQ2xqVllQQUFDc09DSkZSVVcydHJhc1JDa1pBQUNEZzRPdFRTOU5UVTF4Y1hHdlpEMWphbXFibTV2SXlNZ05FQlF0S2hWSFFTWlhUeThNREFXNmxGcTNoRkMyZGtlQ2RVY2NHdzRvSXhhdExSdXNIUkk0TVI2b2xsdDZXMXVKZlgxakZSVmZHeHRvUVVFdVFFQlhLU2xtS2lwalZWVXlBQUJGVWxKQUFBQTJPVGtxTFMyVGZVeFFQajRBRmhZNExSRnpwNmlUQUFBRHpFbE

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.668858050253984
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Document 101-116.pdf
File size:	37'593 bytes
MD5:	09fcd457a331137b2891ac2913680ddb
SHA1:	12a0d6a2f1bce37eb214f83c6697d2de54c28bfd
SHA256:	a057ba83208be579940254b56ce402625d88c669fee1e4ca93085565dee1f37a
SHA512:	cfe78788c12514bdc157390432e341c39a9fa59714afa8e4d281bcce523ba7d8f7eeae137e672d1c27fb4cb9c366cedfe144aa1a4d9f36e7a8e4188a47f8fd00
SSDEEP:	768:yl3INRprP0HZW8YdUzSFOCwS4NDyiZbxvA+FzwsZVnG5ttG/Fs1Dn5HkCa0pNW+H:Bh8CwjNDLZtIQzwq0tMFs1L5HkCa0XH
TLSH:	2AF2AF51980D2ACCD7A452D13F9A742EAAAEB22234C448917C3DC3C363D1F6EE91719A
File Content Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 19 0 R/MarkInfo<</Marked true>>/Metadata 44 0 R/ViewerPreferences 45 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/R

General
Header:	%PDF-1.7
Total Entropy:	7.668858
Total Bytes:	37593
Stream Entropy:	7.787253
Stream Bytes:	32074
Entropy outside Streams:	5.175550
Bytes outside Streams:	5519
Number of EOF found:	2
Bytes after EOF:

Name	Count
obj	28
endobj	28
stream	8
endstream	8
xref	2
trailer	2
startxref	2
/Page	1
/Encrypt	0
/ObjStm	1
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 21:40:59.075407028 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 21:40:59.387696028 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 21:40:59.997009039 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 21:41:01.200146914 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 21:41:02.761861086 CET	49680	443	192.168.2.4	204.79.197.222
Mar 19, 2025 21:41:03.277548075 CET	49681	80	192.168.2.4	2.17.190.73
Mar 19, 2025 21:41:03.614752054 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 21:41:07.849641085 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 21:41:08.196371078 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 21:41:08.431050062 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 21:41:08.890921116 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 21:41:10.098443031 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 21:41:12.504734039 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 21:41:12.537801027 CET	49710	443	192.168.2.4	204.79.197.222
Mar 19, 2025 21:41:12.537801027 CET	49710	443	192.168.2.4	204.79.197.222
Mar 19, 2025 21:41:12.537898064 CET	49710	443	192.168.2.4	204.79.197.222
Mar 19, 2025 21:41:12.629251003 CET	443	49710	204.79.197.222	192.168.2.4
Mar 19, 2025 21:41:12.629270077 CET	443	49710	204.79.197.222	192.168.2.4
Mar 19, 2025 21:41:12.629281044 CET	443	49710	204.79.197.222	192.168.2.4
Mar 19, 2025 21:41:12.630141020 CET	443	49710	204.79.197.222	192.168.2.4
Mar 19, 2025 21:41:12.630151987 CET	443	49710	204.79.197.222	192.168.2.4
Mar 19, 2025 21:41:12.630326033 CET	49710	443	192.168.2.4	204.79.197.222
Mar 19, 2025 21:41:12.631623030 CET	443	49710	204.79.197.222	192.168.2.4
Mar 19, 2025 21:41:12.631679058 CET	49710	443	192.168.2.4	204.79.197.222
Mar 19, 2025 21:41:12.631710052 CET	443	49710	204.79.197.222	192.168.2.4
Mar 19, 2025 21:41:12.631776094 CET	49710	443	192.168.2.4	204.79.197.222
Mar 19, 2025 21:41:12.632529974 CET	49710	443	192.168.2.4	204.79.197.222
Mar 19, 2025 21:41:12.723635912 CET	443	49710	204.79.197.222	192.168.2.4
Mar 19, 2025 21:41:13.055002928 CET	49731	80	192.168.2.4	23.39.37.95
Mar 19, 2025 21:41:13.148750067 CET	80	49731	23.39.37.95	192.168.2.4
Mar 19, 2025 21:41:13.148900986 CET	49731	80	192.168.2.4	23.39.37.95
Mar 19, 2025 21:41:13.148992062 CET	49731	80	192.168.2.4	23.39.37.95
Mar 19, 2025 21:41:13.245624065 CET	80	49731	23.39.37.95	192.168.2.4
Mar 19, 2025 21:41:13.246731997 CET	80	49731	23.39.37.95	192.168.2.4
Mar 19, 2025 21:41:13.246773005 CET	80	49731	23.39.37.95	192.168.2.4
Mar 19, 2025 21:41:13.246817112 CET	49731	80	192.168.2.4	23.39.37.95
Mar 19, 2025 21:41:17.307833910 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 21:41:18.038047075 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 21:41:24.587553978 CET	49731	80	192.168.2.4	23.39.37.95
Mar 19, 2025 21:41:26.918581009 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 21:41:30.744764090 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:30.744844913 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:30.744930983 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:30.745131969 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:30.745156050 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:30.951015949 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:30.951100111 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:30.952503920 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:30.952522039 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:30.952847958 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:30.993006945 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:34.637595892 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:34.680356026 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:34.763194084 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:34.763238907 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:34.763292074 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:34.763295889 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:34.763334036 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:34.763387918 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:34.769510031 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:34.772964001 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:34.773052931 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:34.773060083 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:34.776928902 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:34.777004957 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:34.777126074 CET	49746	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:41:34.777137995 CET	443	49746	142.251.40.164	192.168.2.4
Mar 19, 2025 21:41:45.527916908 CET	49715	80	192.168.2.4	142.251.40.195
Mar 19, 2025 21:41:45.618599892 CET	80	49715	142.251.40.195	192.168.2.4
Mar 19, 2025 21:41:45.618664026 CET	49715	80	192.168.2.4	142.251.40.195
Mar 19, 2025 21:41:45.687686920 CET	49716	443	192.168.2.4	23.44.201.8
Mar 19, 2025 21:42:30.717183113 CET	49757	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:42:30.717274904 CET	443	49757	142.251.40.164	192.168.2.4
Mar 19, 2025 21:42:30.717371941 CET	49757	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:42:30.717680931 CET	49757	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:42:30.717719078 CET	443	49757	142.251.40.164	192.168.2.4
Mar 19, 2025 21:42:30.953443050 CET	443	49757	142.251.40.164	192.168.2.4
Mar 19, 2025 21:42:30.953953028 CET	49757	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:42:30.954020023 CET	443	49757	142.251.40.164	192.168.2.4
Mar 19, 2025 21:42:34.028043032 CET	49711	443	192.168.2.4	40.126.24.148
Mar 19, 2025 21:42:34.137054920 CET	443	49711	40.126.24.148	192.168.2.4
Mar 19, 2025 21:42:34.137264013 CET	49711	443	192.168.2.4	40.126.24.148
Mar 19, 2025 21:42:40.932137012 CET	443	49757	142.251.40.164	192.168.2.4
Mar 19, 2025 21:42:40.932251930 CET	443	49757	142.251.40.164	192.168.2.4
Mar 19, 2025 21:42:40.932434082 CET	49757	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:42:42.391014099 CET	49757	443	192.168.2.4	142.251.40.164
Mar 19, 2025 21:42:42.391088009 CET	443	49757	142.251.40.164	192.168.2.4
Mar 19, 2025 21:42:43.574912071 CET	49708	443	192.168.2.4	52.113.196.254
Mar 19, 2025 21:42:43.919378042 CET	49709	443	192.168.2.4	131.253.33.254
Mar 19, 2025 21:43:21.183115005 CET	443	49710	204.79.197.222	192.168.2.4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 21:41:12.954715967 CET	52693	53	192.168.2.4	1.1.1.1
Mar 19, 2025 21:41:13.050573111 CET	53	52693	1.1.1.1	192.168.2.4
Mar 19, 2025 21:41:26.423909903 CET	53	49737	1.1.1.1	192.168.2.4
Mar 19, 2025 21:41:26.423959017 CET	53	62251	1.1.1.1	192.168.2.4
Mar 19, 2025 21:41:26.463268995 CET	53	63310	1.1.1.1	192.168.2.4
Mar 19, 2025 21:41:27.157135010 CET	53	64767	1.1.1.1	192.168.2.4
Mar 19, 2025 21:41:30.650383949 CET	57217	53	192.168.2.4	1.1.1.1
Mar 19, 2025 21:41:30.650592089 CET	57140	53	192.168.2.4	1.1.1.1
Mar 19, 2025 21:41:30.743504047 CET	53	57140	1.1.1.1	192.168.2.4
Mar 19, 2025 21:41:30.743844032 CET	53	57217	1.1.1.1	192.168.2.4
Mar 19, 2025 21:41:35.739667892 CET	53	63576	1.1.1.1	192.168.2.4
Mar 19, 2025 21:41:44.096683025 CET	53	60913	1.1.1.1	192.168.2.4
Mar 19, 2025 21:42:02.896543980 CET	53	56600	1.1.1.1	192.168.2.4
Mar 19, 2025 21:42:07.284194946 CET	138	138	192.168.2.4	192.168.2.255
Mar 19, 2025 21:42:25.526196957 CET	53	56670	1.1.1.1	192.168.2.4
Mar 19, 2025 21:42:25.911737919 CET	53	63760	1.1.1.1	192.168.2.4
Mar 19, 2025 21:42:29.438354015 CET	53	62697	1.1.1.1	192.168.2.4
Mar 19, 2025 21:42:56.513233900 CET	53	63740	1.1.1.1	192.168.2.4
Mar 19, 2025 21:43:41.701715946 CET	53	63456	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Mar 19, 2025 21:41:13.148992062 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Mar 19, 2025 21:41:13.246731997 CET	1257	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=55297 Expires: Thu, 20 Mar 2025 12:02:50 GMT Date: Wed, 19 Mar 2025 20:41:13 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUXPi ')au\n
Mar 19, 2025 21:41:13.246773005 CET	488	IN	Data Raw: f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 1b 45 f0 66 95 d2 7c 6f c2 ea 3b ef 1f cf cb d6 ae 27 f1 a9 b0 Data Ascii: i/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj,_(.{q{^

Timestamp	Bytes transferred	Direction	Data
2025-03-19 20:41:34 UTC	579	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJShywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCIrgzgEIruTOAQiL5c4B Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 20:41:34 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 20:41:34 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-MGE5f1_iItKPyzbtlbCjyQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-19 20:41:34 UTC	1303	IN	Data Raw: 65 63 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 61 6e 20 66 72 61 6e 63 69 73 63 6f 20 34 39 65 72 73 22 2c 22 6e 69 6b 65 20 73 62 20 61 69 72 20 6a 6f 72 64 61 6e 20 34 20 6e 61 76 79 22 2c 22 61 70 70 6c 65 20 69 70 68 6f 6e 65 20 31 37 20 70 72 6f 20 6d 61 78 22 2c 22 73 6f 75 74 68 77 65 73 74 20 61 69 72 6c 69 6e 65 73 22 2c 22 73 70 61 63 65 78 20 6e 61 73 61 20 61 73 74 72 6f 6e 61 75 74 73 22 2c 22 73 6f 75 74 68 77 65 73 74 20 61 69 72 6c 69 6e 65 73 20 63 68 65 63 6b 65 64 20 62 61 67 73 22 2c 22 6d 6c 62 20 64 6f 64 67 65 72 73 20 63 75 62 73 22 2c 22 61 73 73 61 73 73 69 6e 20 63 72 65 65 64 20 73 68 61 64 6f 77 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 Data Ascii: ecd)]}'["",["san francisco 49ers","nike sb air jordan 4 navy","apple iphone 17 pro max","southwest airlines","spacex nasa astronauts","southwest airlines checked bags","mlb dodgers cubs","assassin creed shadows"],["","","","","","","",""],[],{"google:c
2025-03-19 20:41:34 UTC	1303	IN	Data Raw: 59 6b 31 6c 64 55 31 61 63 46 52 4c 61 6a 4a 32 59 6e 52 30 5a 56 42 55 65 47 4e 59 59 54 68 42 57 44 56 7a 61 48 64 59 61 30 39 4b 4f 43 39 44 53 55 78 75 57 47 63 76 59 30 39 4c 53 58 41 77 57 44 6c 68 4c 33 46 51 64 57 74 54 51 79 39 31 59 6b 70 71 51 30 70 6d 63 56 4a 4e 54 57 46 48 53 48 56 6a 55 48 52 31 4d 31 52 50 4d 57 64 6f 5a 6e 46 32 61 58 56 6b 59 6c 68 6b 57 48 52 74 61 47 78 4c 65 6b 6c 43 53 47 70 6c 63 44 59 76 62 31 4a 4c 52 33 4e 4a 5a 6b 74 6b 56 32 6f 7a 61 47 59 79 5a 6e 5a 50 63 56 4e 72 59 54 4e 78 63 46 49 33 57 6d 68 56 57 55 52 32 62 54 5a 30 59 6c 64 48 4f 47 51 34 57 57 4e 4b 57 44 41 30 63 33 4a 61 4e 6e 4d 32 4e 33 46 74 62 6c 4a 70 4f 56 46 6b 56 33 45 31 51 56 51 30 63 46 64 75 5a 54 56 53 56 33 4e 6f 52 44 6c 50 63 6b 31 Data Ascii: Yk1ldU1acFRLajJ2YnR0ZVBUeGNYYThBWDVzaHdYa09KOC9DSUxuWGcvY09LSXAwWDlhL3FQdWtTQy91YkpqQ0pmcVJNTWFHSHVjUHR1M1RPMWdoZnF2aXVkYlhkWHRtaGxLeklCSGplcDYvb1JLR3NJZktkV2ozaGYyZnZPcVNrYTNxcFI3WmhVWUR2bTZ0YldHOGQ4WWNKWDA0c3JaNnM2N3FtblJpOVFkV3E1QVQ0cFduZTVSV3NoRDlPck1
2025-03-19 20:41:34 UTC	1190	IN	Data Raw: 46 53 6d 35 49 57 69 74 4e 61 46 6c 47 65 6a 4d 30 4e 47 68 54 4e 6d 35 53 4c 33 63 35 4d 32 4e 72 64 44 5a 6f 54 54 46 53 59 55 39 50 55 69 74 30 65 47 5a 50 55 33 46 46 54 58 6c 7a 63 46 70 30 53 55 5a 4e 52 33 56 77 53 46 41 78 54 58 4d 78 4b 33 52 6a 4e 58 70 4f 64 7a 4e 79 53 47 52 45 4d 33 6c 6c 53 45 56 44 63 58 64 4e 4d 56 56 6f 5a 57 34 34 62 6e 52 6b 4c 30 46 4e 57 6b 52 5a 62 56 52 77 5a 6d 63 72 5a 45 46 42 51 55 46 42 52 57 78 47 56 47 74 54 64 56 46 74 51 30 4d 36 45 31 4e 68 62 69 42 47 63 6d 46 75 59 32 6c 7a 59 32 38 67 4e 44 6c 6c 63 6e 4e 4b 42 79 4e 68 4d 7a 41 77 4d 44 42 53 50 6d 64 7a 58 33 4e 7a 63 44 31 6c 53 6e 70 71 4e 48 52 45 55 44 46 55 59 33 64 4c 4f 48 46 79 54 6b 64 45 4d 45 56 70 4e 55 39 36 52 6b 35 4a 53 7a 42 79 54 56 Data Ascii: FSm5IWitNaFlGejM0NGhTNm5SL3c5M2NrdDZoTTFSYU9PUit0eGZPU3FFTXlzcFp0SUZNR3VwSFAxTXMxK3RjNXpOdzNySGREM3llSEVDcXdNMVVoZW44bnRkL0FNWkRZbVRwZmcrZEFBQUFBRWxGVGtTdVFtQ0M6E1NhbiBGcmFuY2lzY28gNDllcnNKByNhMzAwMDBSPmdzX3NzcD1lSnpqNHREUDFUY3dLOHFyTkdEMEVpNU96Rk5JSzByTV
2025-03-19 20:41:34 UTC	92	IN	Data Raw: 35 36 0d 0a 4f 46 42 77 64 47 6c 49 57 46 42 73 4f 45 46 51 64 55 74 79 61 46 55 7a 4d 6a 64 68 53 54 4a 5a 62 6b 4e 6d 57 6e 46 6a 5a 43 38 34 4f 48 4d 33 5a 55 4d 31 62 47 74 78 4d 48 64 44 5a 30 5a 42 53 30 46 56 51 57 39 44 63 79 73 77 57 6a 6c 30 63 6d 68 4c 57 54 0d 0a Data Ascii: 56OFBwdGlIWFBsOEFQdUtyaFUzMjdhSTJZbkNmWnFjZC84OHM3ZUM1bGtxMHdDZ0ZBS0FVQW9DcyswWjl0cmhLWT
2025-03-19 20:41:34 UTC	1223	IN	Data Raw: 39 65 66 0d 0a 42 30 5a 31 42 31 55 33 52 4e 5a 47 68 7a 4f 44 46 50 53 30 39 43 61 6e 68 49 55 44 42 78 62 58 55 76 64 54 4a 6c 62 48 4e 74 52 47 56 4d 61 6b 70 50 65 57 70 74 4d 33 6c 58 64 6e 4e 53 4d 33 4e 78 56 6a 64 32 59 55 70 73 63 47 5a 68 52 46 55 79 4d 33 6c 73 62 32 5a 55 4d 7a 56 50 55 57 5a 31 55 46 4e 76 4e 47 4a 4c 54 47 6b 35 56 57 46 4f 64 48 4a 6d 63 6c 4a 79 65 47 51 30 65 6c 4e 68 54 48 5a 58 5a 7a 68 56 56 55 46 76 51 6c 46 44 5a 30 5a 42 56 6b 64 54 64 47 51 35 4e 44 5a 61 61 55 6f 7a 5a 31 64 57 51 57 56 6c 54 30 35 73 65 55 5a 6d 61 30 67 72 62 7a 4d 34 64 32 46 76 5a 6d 5a 78 4d 6a 52 4d 4d 56 42 57 5a 32 78 6f 63 30 4d 31 4c 30 5a 56 65 56 67 33 56 6e 49 34 4f 55 39 6f 63 48 56 34 54 6d 63 30 4b 32 68 59 54 45 64 74 52 6d 51 77 Data Ascii: 9efB0Z1B1U3RNZGhzODFPS09CanhIUDBxbXUvdTJlbHNtRGVMakpPeWptM3lXdnNSM3NxVjd2YUpscGZhRFUyM3lsb2ZUMzVPUWZ1UFNvNGJLTGk5VWFOdHJmclJyeGQ0elNhTHZXZzhVVUFvQlFDZ0ZBVkdTdGQ5NDZaaUozZ1dWQWVlT05seUZma0grbzM4d2FvZmZxMjRMMVBWZ2xoc0M1L0ZVeVg3VnI4OU9ocHV4Tmc0K2hYTEdtRmQw
2025-03-19 20:41:34 UTC	1223	IN	Data Raw: 64 33 70 31 52 6a 56 55 63 6e 6c 44 56 48 59 78 59 32 35 32 4e 54 46 5a 61 32 74 79 53 58 67 78 53 32 73 32 63 32 35 50 59 6e 55 79 56 45 35 6b 53 55 4e 6e 52 6b 46 5a 61 33 49 7a 64 30 55 76 56 32 64 4a 51 57 4e 4e 54 55 64 55 4d 48 70 36 63 57 78 6b 53 7a 4e 77 62 45 6f 78 53 45 52 34 51 33 6b 30 52 6d 5a 4d 63 46 56 30 64 32 64 45 62 48 49 79 64 31 46 44 51 55 39 47 56 6e 4e 72 53 6d 52 71 55 45 35 52 54 6c 4d 35 56 48 70 35 4d 54 64 6f 56 45 52 74 61 6b 45 77 62 6b 38 72 63 6c 56 52 63 46 46 34 63 54 56 75 5a 6b 70 76 52 45 55 79 63 44 6c 76 51 58 4e 58 4f 55 39 56 53 6b 4e 46 51 6b 6c 56 54 6e 52 44 61 55 46 4f 64 30 46 4f 57 6e 64 43 65 56 52 72 4e 45 46 43 54 31 46 4b 55 32 52 33 4e 6e 68 4b 61 56 4e 4a 65 6c 64 73 61 45 56 73 64 33 56 31 4e 44 4e Data Ascii: d3p1RjVUcnlDVHYxY252NTFZa2tySXgxS2s2c25PYnUyVE5kSUNnRkFZa3Izd0UvV2dJQWNNTUdUMHp6cWxkSzNwbEoxSER4Q3k0RmZMcFV0d2dEbHIyd1FDQU9GVnNrSmRqUE5RTlM5VHp5MTdoVERtakEwbk8rclVRcFF4cTVuZkpvREUycDlvQXNXOU9VSkNFQklVTnRDaUFOd0FOWndCeVRrNEFCT1FKU2R3NnhKaVNJeldsaEVsd3V1NDN
2025-03-19 20:41:34 UTC	104	IN	Data Raw: 33 2c 33 36 32 2c 33 30 38 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 5d 7d 5d 0d 0a Data Ascii: 3,362,308]],"google:suggesttype":["ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","ENTITY"]}]
2025-03-19 20:41:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Document 101-116.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ccb81a32-6087-4ffa-bfc7-0f76f6ec2af5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250319204105Z-208.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Windows Analysis Report
Document 101-116.pdf

Target ID:	0
Start time:	16:40:58
Start date:	19/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Document 101-116.pdf"
Imagebase:	0x7ff7dc980000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	16:40:59
Start date:	19/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff7278c0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	16:41:01
Start date:	19/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1596 --field-trial-handle=1592,i,56940659623526008,9426062706914596360,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff7278c0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	19
Start time:	16:41:24
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://storage.googleapis.com/dlbrautigan/index.html"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre