Edit tour

Windows Analysis Report
http://res.pdfonestartlive.com

Overview

General Information

Sample URL:	http://res.pdfonestartlive.com
Analysis ID:	1560882
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected landing page (webpage, office document or email)

Checks for available system drives (often done to infect USB drives)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

HTML page contains hidden javascript code

Queries the volume information (name, serial number etc) of a device

Sigma detected: Msiexec Initiated Connection

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1976,i,5281757183394232775,13100573058811160957,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msiexec.exe (PID: 7576 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Downloads\PDFOneStartLive.msi" MD5: E5DA170027542E25EDE42FC54C929077)

chrome.exe (PID: 6248 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://res.pdfonestartlive.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 2848 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

OpenWith.exe (PID: 2712 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

Acrobat.exe (PID: 7476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\download" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

msiexec.exe (PID: 7560 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1776 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 3DB88ADCDA978ADF5BD9E44A359F2DEB C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1436 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 399B88921F263A27E753DCA4D1E1782B MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Sigma Signatures

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 65.9.112.121, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 1436, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49792

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://resources.onestart.ai/onestart_installer_128.0.6613.124.exe

Avira URL Cloud: Label: malware

Phishing

AI detected landing page (webpage, office document or email)

Source: https://pdfonestartlive.com/	Joe Sandbox AI: Page contains button: 'DOWNLOAD NOW' Source: '1.0.pages.csv'
Source: https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670#	Joe Sandbox AI: Page contains button: 'Click "Continue"' Source: '3.8.pages.csv'

Source: https://pdfonestartlive.com/

HTTP Parser: Base64 decoded: {"version":3,"sources":["webpack://./../../.yarn/__virtual__/@termly-react-components-virtual-d20d8fbfab/0/cache/@termly-react-components-npm-3.6.3-4f5cb71732-eba2e81f60.zip/node_modules/@termly/react-components/src/components/Button/styles.module.sass"],...

Source: https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670	HTTP Parser: No favicon
Source: https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49746 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Windows\System32\msiexec.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: res.pdfonestartlive.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /onestart_installer_128.0.6613.124.exe HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: resources.onestart.aiConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: res.pdfonestartlive.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: pdfonestartlive.com
Source: global traffic	DNS traffic detected: DNS query: app.termly.io
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: speedinovaton.com
Source: global traffic	DNS traffic detected: DNS query: resources.onestart.ai

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49746 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\60ac3a.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIADB1.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAE10.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAE5F.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{4338DD3D-C6E7-44F1-8FDD-8394E9076A9A}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAECE.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAF0D.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB018.tmp

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIADB1.tmp

Source: classification engine

Classification label: mal52.win@34/57@29/187

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\System32\OpenWith.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2712:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSI96BE.tmp

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1976,i,5281757183394232775,13100573058811160957,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://res.pdfonestartlive.com"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1976,i,5281757183394232775,13100573058811160957,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\download"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\download"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Downloads\PDFOneStartLive.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3DB88ADCDA978ADF5BD9E44A359F2DEB C
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Downloads\PDFOneStartLive.msi"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3DB88ADCDA978ADF5BD9E44A359F2DEB C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 399B88921F263A27E753DCA4D1E1782B
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 399B88921F263A27E753DCA4D1E1782B
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: smartscreenps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: shdocvw.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: atlthunk.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netprofm.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: npmproxy.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\OneStart.ai\OneStart Installer\onestart_installer.exe.part	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAF0D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI983A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI96BE.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSIAF0D.tmp

Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Users\user\AppData\Local\OneStart.ai\OneStart Installer\onestart_installer.exe.part

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\OneStart.ai\OneStart Installer\onestart_installer.exe.part	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIAF0D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI983A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI96BE.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\OpenWith.exe

Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\download"

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	1 Browser Extensions	11 Process Injection	31 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	11 Process Injection	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Rundll32	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
http://res.pdfonestartlive.com	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\MSI96BE.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI983A.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIAF0D.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://res.pdfonestartlive.com/	0%	Avira URL Cloud	safe
http://resources.onestart.ai/onestart_installer_128.0.6613.124.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
googleads.g.doubleclick.net	172.217.19.194	true	false	high
res.pdfonestartlive.com	18.66.122.98	true	false	unknown
www.google.com	142.250.181.100	true	false	high
pdfonestartlive.com	18.244.18.59	true	false	unknown
app.termly.io	104.18.30.234	true	false	high
td.doubleclick.net	172.217.19.226	true	false	high
resources.onestart.ai	65.9.112.121	true	false	unknown
speedinovaton.com	143.204.215.6	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670	true		unknown
http://res.pdfonestartlive.com/	false	Avira URL Cloud: safe	unknown
https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670#	true		unknown
http://resources.onestart.ai/onestart_installer_128.0.6613.124.exe	true	Avira URL Cloud: malware	unknown
https://pdfonestartlive.com/	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.18.31.234	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.19.226	td.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
18.244.18.9	unknown	United States	16509	AMAZON-02US	false
216.58.208.226	unknown	United States	15169	GOOGLEUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
104.18.21.226	unknown	United States	13335	CLOUDFLARENETUS	false
18.244.18.59	pdfonestartlive.com	United States	16509	AMAZON-02US	false
65.9.112.121	resources.onestart.ai	United States	16509	AMAZON-02US	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
74.125.205.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.18.30.234	app.termly.io	United States	13335	CLOUDFLARENETUS	false
143.204.215.6	speedinovaton.com	United States	16509	AMAZON-02US	false
172.217.19.194	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.19.170	unknown	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
2.20.68.210	unknown	European Union	37457	Telkom-InternetZA	false
18.66.122.98	res.pdfonestartlive.com	United States	3	MIT-GATEWAYSUS	false
172.217.17.72	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560882
Start date and time:	2024-11-22 13:38:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://res.pdfonestartlive.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.win@34/57@29/187

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.19.238, 74.125.205.84, 34.104.35.123
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://res.pdfonestartlive.com

LLM Input / Output

Input	Output
URL: http://res.pdfonestartlive.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: http://res.pdfonestartlive.com
URL: https://pdfonestartlive.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "ACCELERATE YOUR PDF PROJECTS", "prominent_button_name": "DOWNLOAD NOW", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://pdfonestartlive.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://pdfonestartlive.com
URL: https://pdfonestartlive.com/ Model: Joe Sandbox AI	{ "brands": [ "PDF One Start Live" ] }
	{ "brands": [ "PDF One Start Live" ] }
URL: https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Download Progress:", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670 Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Click here to try again", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670 Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670# Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Click above Then click the PDF installer file", "prominent_button_name": "Click \"Continue\"", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670# Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }

Created / dropped Files

C:\Config.Msi\60ac3b.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	796900
Entropy (8bit):	6.727152560582398
Encrypted:	false
SSDEEP:
MD5:	EB9FD369195B393C977587FD35424C3A
SHA1:	A5403E7C4CBD6C3E5CE6B9DF1D45925EFFB466D6
SHA-256:	4DD8A7F56CC94E2260ED72ECD864D352654B7909993DF8F64BAA0272A1F530EA
SHA-512:	1A767A1DB4644E53EEAA02F2E63B1D52AFD59753B4A11702B977EB875DD15355211989F20F1CE64F800D5134DB320C785AA6D8B3954313EAC176FAEAA4C970A6
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.=vY.@.....@.....@.....@.....@.....@......&.{4338DD3D-C6E7-44F1-8FDD-8394E9076A9A}..OneStart PDF..PDFOneStartLive.msi.@.....@.....@.....@........&.{4CEC43B9-B497-4A5C-A703-63AB7ADA95E6}.....@.....@.....@.....@.......@.....@.....@.......@......OneStart PDF......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{FEE34822-BEE6-46CA-8BC7-812252175977}&.{4338DD3D-C6E7-44F1-8FDD-8394E9076A9A}.@......&.{D8511B6D-3FAD-4D18-929C-23F5ACD99D44}&.{4338DD3D-C6E7-44F1-8FDD-8394E9076A9A}.@........CreateFolders..Creating folders..Folder: [1]#.(.C:\Users\user\AppData\Local\OneStart.ai\.@....#.;.C:\Users\user\AppData\Local\OneStart.ai\OneStart Installer\.@........AI_FdRollback..Rolling back downloaded files#.Rolling back downloaded file: "[1]"L...AI_FdRollback.@.-....h$..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	unknown
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.676048742462893
Encrypted:	false
SSDEEP:
MD5:	E94FB54871208C00DF70F708AC47085B
SHA1:	4EFC31460C619ECAE59C1BCE2C008036D94C84B8
SHA-256:	7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
SHA-512:	2E15B76E16264ABB9F5EF417752A1CBB75F29C11F96AC7D73793172BD0864DB65F2D2B7BE0F16BBBE686068F0C368815525F1E39DB5A0D6CA3AB18BE6923B898
Malicious:	false
Reputation:	unknown
Preview:	0..r0..Z.......vS..uFH....JH:N.0....H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...200318000000Z..450318000000Z0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450.."0....H.............0.........-.0.z.=.r.:K..a....g.7..~.....C..E..cW]....%..h.K..K.J...j..a'..D...?".O.....(..].Y.......,.3$.P:A..{.M.X8.........,..C...t...{.3..Yk....Z.{..U......L...u.o.a.tD....t..h.l&>.......0....\|U..p\$x %.gg...N4.kp..8...........;.gC....t./.....7=gl.E\.a.A.....w.FGs.....+....X.W..Z..%....r=....;D.&.........E.......Bng~B.qb...`.d....!N+.mh...tsg1z...yn\|..~FoM..+."D...7..aW...$..1s..5WG~.:E.-.Q.....7.e...k.w....?.0.o1..@........PvtY..m.2...~...u..J.,....+B..j6..L.............:.c...$d.......B0@0...U...........0...U.......0....0...U.........F...x9...C.VP..;0...*.H.............^+.t.4D_vH(@....n..%.{...=..v...0 ..`.....x.+.2..$.RR......9n....CA}..[.]...&..tr&....=;jR.<../.{.3.E.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1356875516282012
Encrypted:	false
SSDEEP:
MD5:	E8A14855C30100CAFB4EA3214DDB42AF
SHA1:	967E5F982F6F7F97E910E3266A497B5C075E9ECB
SHA-256:	AFB793626733A4B1CF46C11713E4F2ED07EA76E600E785C46841E887FE3B4204
SHA-512:	1F4644687AB5350461929DE5B337299D67A22799433DEA04319521C3DCD9373D718336073B8FF230C45EC466A0E81F4D59E4CBEB5E72117BCCB1C78E6EB20D0C
Malicious:	false
Reputation:	unknown
Preview:	p...... .........:...<..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.0978749002776924
Encrypted:	false
SSDEEP:
MD5:	7E94832412DD0F4CBFE30D30DCBF72E4
SHA1:	F43E900AE0AEF5991FCB3556CB90631A60527276
SHA-256:	81446D0D8358592CC24B972240DFD22DB29765F002DDAACBDF3077AF68221084
SHA-512:	960C1355C0A09011D63E095FBFF7B07E888081DFF83219BF2802F9C2C049992472E14C120EEA6785FC506610792E83A32CD96BC877E0DC4AA697F4263DDC0D65
Malicious:	false
Reputation:	unknown
Preview:	p...... ....v.....1..<..(....................................................... ...............(.............v...h.t.t.p.:././.s.e.c.u.r.e...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.a.c.e.r.t./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5...c.r.t...".6.2.f.a.4.8.4.5.-.5.7.6."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	227002
Entropy (8bit):	3.392780893644728
Encrypted:	false
SSDEEP:
MD5:	265E3E1166312A864FB63291EA661C6A
SHA1:	80DFF3187FF929596EB22E1DB9021BAD6F97178C
SHA-256:	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
SHA-512:	48776A2BFE8F25E5601DCC0137F7AB103D5684517334B806E3ACF61683DD9B283828475FC85CE0CBE4E8AF88E6F8B25EED0A77640E2CFFF2CC73708726519AFA
Malicious:	false
Reputation:	unknown
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2818
Entropy (8bit):	5.144452512608312
Encrypted:	false
SSDEEP:
MD5:	5EB2DCF6880ECD79589128247908F2A7
SHA1:	E657CD32BBD06CBED25F7F00B171EB7AE07EEAF7
SHA-256:	4BEBB236F3D0975229C8FD913DC9A31332D555E8FD014A95B8FF2C538AB2CB6C
SHA-512:	785C099AF7590C2F69439353C27603FF3BE315AED62628E413CD16791BA517907651FD0A433383E04778E22F8829625BE012F4593681AE14E495F710FA0C088F
Malicious:	false
Reputation:	unknown
Preview:	{"all":[{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f44756c6e08822e64c0e471a2499e34d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696585148000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e8f53b6740aba22a83a1a569cebedbcc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696585148000},{"id":"DC_Reader_Upsell_Cards","info":{"dg":"7f7864d14ddfb32712806b54466336e7","sid":"DC_Reader_Upsell_Cards"},"mimeType":"file","size":5220,"ts":1696585148000},{"id":"ACROBAT_READER_MASTER_SURFACEID","info":{"dg":"d01f2f8f10261bfe5b6c0f6923d8ac2e","sid":"ACROBAT_READER_MASTER_SURFACEID"},"mimeType":"file","size":295,"ts":1696585148000},{"id":"DC_READER_LAUNCH_CARD","info":{"dg":"243b14d2a26c2620c5e79e7da23ec83f","sid":"DC_READER_LAUNCH_CARD"},"mimeType":"file","size":285,"ts":1696585148000},{"id":"DC_FirstMile_Home_View_Surface","info":{"dg":"e60a17134c5dc41d99acfacff34ba00a","sid":"DC_FirstMile_Home_View_Surface"},"mimeType":"file","size

C:\Users\user\AppData\Local\OneStart.ai\OneStart Installer\onestart_installer.exe.part

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	17904848
Entropy (8bit):	7.973424747010861
Encrypted:	false
SSDEEP:
MD5:	C9F13C8B5BEA6E757FADDA7E96EDB7B9
SHA1:	E51FBE62EBEF74CA4E34244013CF487BA9156371
SHA-256:	404C4DB9D961596DAD15EE681148850CB3ACDA791D3FFB73BC0643FBB30E76DB
SHA-512:	49AEDCE639C19D2C79B33B92CF38ADC1EE7CEB4A09D0A2D727E8B10F7BB3D9C14CCC15D4B5D9F959443B313338C42F8DD021F3429F0A2C8AD6AEBDEDCB445871
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......d...........`.........@.............................@......`#....`..........................................H..W...(I......................8..@(... ......,:.......................9..(.......@............Q...............................text....c.......d.................. ..`.rdata..<x.......z...h..............@..@.data...............................@....pdata.............................@..@.gxfg...@.... ...0...R..............@..@.retplne.....P...........................tls....I....`......................@..._RDATA.......p......................@..@.rsrc...............................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI96BE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI983A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1201504
Entropy (8bit):	6.4558508565404535
Encrypted:	false
SSDEEP:
MD5:	03CC8828BB0E0105915B7695B1EC8D88
SHA1:	CBF8EC531EA7E3EE58B51BD642F8BFABDC759EE1
SHA-256:	0E1491AE7344F3A5EC824732648CCDDA19B271D6F01471793BF292840FC83B5E
SHA-512:	593A76166EB6CE2E3537B0D93E216DAEF12E4AB5B181A194B55A90B39A1AF2E0374C4EC3833A000530425319A003CD1A648489640FCCAF108061EBEA1D9CB1E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............@G..@G..@G.yCF..@G.yEF..@G.\|CF..@G.\|DF..@G.\|EF..@G.yDF..@G.yAF..@G..AG..@G.}IF..@G.}@F..@G.}.G..@G...G..@G.}BF..@GRich..@G........PE..L...v..f.........."!...).~..........Pq.......................................`............@A........................ ...t...............................`=.......l......p........................... ...@...............L............................text...J}.......~.................. ..`.rdata...;.......<..................@..@.data...............................@....fptable............................@....rsrc...............................@..@.reloc...l.......n..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 11:38:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9853277175433166
Encrypted:	false
SSDEEP:
MD5:	68340073CD3ECB3655850486074E95F4
SHA1:	6FF4EB648CA5AFCF26148346CC7D35A5F8406E6E
SHA-256:	A47C42E51A809BC69792A4BF41AE9A63528380A6A7F00110448435CC67FC3DC7
SHA-512:	3AA010D2F3A78BE2409E0BE653D3746B95BB80832F253E2E9A9E4213EEEA0A160B729783FD9EA97159E9C6A0CFCFBF7E737FDA4E90849BD7C0E9418FFCD40FB6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....Uc.~.<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 11:38:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.002321524730746
Encrypted:	false
SSDEEP:
MD5:	599BC1DFE98C32EAA2A281020F4B4CA6
SHA1:	E2E70C3F16D6438062BB6A652F99A1A6342AF2E3
SHA-256:	62EAD5476F03A72B6B7914CB40E31B969A3B30985332A4AFF0488DA4F2743D4C
SHA-512:	AEFC197A37483C4036ABA443BCE49B7BF741C8E33573E443CE50DA9EFCECD1859F47B20C01A372F1F637BD6BA109B78824F1EE86E2A9885A5E28A5A3D6122EC0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....&..~.<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.010249371606739
Encrypted:	false
SSDEEP:
MD5:	FF66A33A8D37564924A5B0543D92344C
SHA1:	B5ED9338AEB0CFEA7822B7A75FDADD8EB5B39A84
SHA-256:	6CD47C2B2A04C48CFCBD45E0D6A25DFFF9F2CAD6E3903EF4198A47FBEA076892
SHA-512:	5DF6BD8E61C1AF18A4C7A90A10EFE89837D77115A40AFA5C66FBB2842622B9C81F2FA45D6851A9CF0AEFDEAE8FD736D46084A1F522639C74365F6D1875A6CBEC
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 11:38:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.002213604492445
Encrypted:	false
SSDEEP:
MD5:	8BE9DE7C18984A542BE2F4E7CC81E8C9
SHA1:	42C271167FFF10648EF8CAF14629070D87DA2C21
SHA-256:	DC5980D93A1AB2CF43B23DC2EBB8284B7FFD370A5B2A1707EB71BB06A42803E5
SHA-512:	19AD0F99023DF91654E19C4859E5312CDA92DC2F66AF4CFD6A256EBB821FB9484354267329665DB7D2897A28DC624CB1C4F45974E1D124013E03A0B0DFBA2945
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....P.~.<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 11:38:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.99138193344633
Encrypted:	false
SSDEEP:
MD5:	1AB0CD05CAE21CC0DFD27AAC78A36A24
SHA1:	D57249598D39E29C6E665E046AF070BF3CCF6BFD
SHA-256:	33622B5FED62AF32B86E4E128727B70A2CFC3EE2902CF70BDD202A01A784E9CB
SHA-512:	BF035F1C116143D92925C6A3E55F5E592BF858D194D1E1FBDD7CE0E9DDD3DDB90D0022DBA9AF9EE91DB7A327051B76D9FE771688044A96A8571EC7EE82271C97
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......~.<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 11:38:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9985348191563226
Encrypted:	false
SSDEEP:
MD5:	40CB7230323AEAB6D82BDE158FF7D2EF
SHA1:	B72C824E396228F3FA4F0451D58FDE8EC5205669
SHA-256:	D5CF9884A40B1DE2B0BABFEACA03329B38B30329A6963AEBFC42C1BB4E457A7A
SHA-512:	A04C90FDFA4B821380D0A6C8179183AED49915A6C77D3D9DC89116A2B14FC3D83ECC8A2607440195B535830A0221C7A987C472AA2270E941E5CBC8DF57653264
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......~.<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY.d....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.d....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.d....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY.d..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.d...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\58e49132-abf8-44f8-9e4d-fd9b8d5351d3.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Composite Document File V2 Document, Can't read SAT
Category:	dropped
Size (bytes):	11781
Entropy (8bit):	5.034386374916252
Encrypted:	false
SSDEEP:
MD5:	5A06AC278CCBD3C846218C00BFE52F6F
SHA1:	AE48B23C6E5AE028A87ACD1BFCB56DD5A9CC1435
SHA-256:	183978D5698478E2778D036AADF13573F57A599AFA79B7014A7E7478B8755F72
SHA-512:	368C660B181FE36868159E2E954C84139A0F8050A67A3EF833F3141C31A5D079A5C37257FFA786E6D766834325BD339E1E5768D8FB9CB1B0C99C453C25919547
Malicious:	false
Reputation:	unknown
Preview:	......................>...................>...................................H.......d.......l...............................a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y.......................................................o......................................................................................................................................................................................................................."...6............................................................................................... ...!...-...#.......%...&...'...(...)...*...+...,......./...4...0...1...2...3...7...5...>...A...8...9...:...;...<...=.......?...@.......B...C...D...E...F...G...........J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Downloads\PDFOneStartLive.msi (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {4CEC43B9-B497-4A5C-A703-63AB7ADA95E6}, Number of Words: 10, Subject: OneStart PDF, Author: OneStart.ai, Name of Creating Application: OneStart PDF, Template: ;1033, Comments: OneStart PDF 4.5.258.2, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Mon Oct 28 02:28:51 2024, Last Saved Time/Date: Mon Oct 28 02:28:51 2024, Last Printed: Mon Oct 28 02:28:51 2024, Number of Pages: 450
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	64A47700C3C27341180FC7DC08704210
SHA1:	30C46E57D9E08A1DACE0C66FF8A8549CF8DD7B98
SHA-256:	4C35ADA0A8C91AF2A483A077D3BDA707C208D942F0F2E8EC601BD663D2C8AEBF
SHA-512:	7CB02054078DA74F13B0A9B44DE8B4BFB5002845B59157948C5785EFC0A776C00AA6316B6B473D63FFF3194CEE1A55811D8E6686764401AE3151169251E7A4B5
Malicious:	false
Reputation:	unknown
Preview:	......................>...................>...................................H.......d.......l...............................a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y.......................................................o......................................................................................................................................................................................................................."...6............................................................................................... ...!...-...#.......%...&...'...(...)...*...+...,......./...4...0...1...2...3...7...5...>...A...8...9...:...;...<...=.......?...@.......B...C...D...E...F...G...........J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Downloads\Unconfirmed 515313.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Composite Document File V2 Document, Can't read SAT
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8863D6AA55C7984B45C17A698A161FB8
SHA1:	0D93BEBE974241C73FCC56B8B05A5F639D971221
SHA-256:	5C76F8B25C8A1878BB7563C88954E80A3824C418CE6ED43B22DD028A73CEE1D8
SHA-512:	D58CE0B7983C0E5B3529CC96C42813EF82584A6B8E783E3FE6F3DE46DBADFDA96694B5876669DF8FC0B25BF13C20FFBA96FEE1CF88A674DBD058EBFF31900176
Malicious:	false
Reputation:	unknown
Preview:	......................>...................>...................................H.......d.......l...............................a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y.......................................................o......................................................................................................................................................................................................................."...6............................................................................................... ...!...-...#.......%...&...'...(...)...*...+...,......./...4...0...1...2...3...7...5...>...A...8...9...:...;...<...=.......?...@.......B...C...D...E...F...G...........J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Downloads\Unconfirmed 579123.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {4CEC43B9-B497-4A5C-A703-63AB7ADA95E6}, Number of Words: 10, Subject: OneStart PDF, Author: OneStart.ai, Name of Creating Application: OneStart PDF, Template: ;1033, Comments: OneStart PDF 4.5.258.2, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Mon Oct 28 02:28:51 2024, Last Saved Time/Date: Mon Oct 28 02:28:51 2024, Last Printed: Mon Oct 28 02:28:51 2024, Number of Pages: 450
Category:	dropped
Size (bytes):	4000768
Entropy (8bit):	6.635640688103337
Encrypted:	false
SSDEEP:
MD5:	64A47700C3C27341180FC7DC08704210
SHA1:	30C46E57D9E08A1DACE0C66FF8A8549CF8DD7B98
SHA-256:	4C35ADA0A8C91AF2A483A077D3BDA707C208D942F0F2E8EC601BD663D2C8AEBF
SHA-512:	7CB02054078DA74F13B0A9B44DE8B4BFB5002845B59157948C5785EFC0A776C00AA6316B6B473D63FFF3194CEE1A55811D8E6686764401AE3151169251E7A4B5
Malicious:	false
Reputation:	unknown
Preview:	......................>...................>...................................H.......d.......l...............................a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y.......................................................o......................................................................................................................................................................................................................."...6............................................................................................... ...!...-...#.......%...&...'...(...)...*...+...,......./...4...0...1...2...3...7...5...>...A...8...9...:...;...<...=.......?...@.......B...C...D...E...F...G...........J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Downloads\ce380c1a-6ad8-4ac2-b5c5-38ce040d38e0.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Composite Document File V2 Document, Can't read SAT
Category:	dropped
Size (bytes):	7865
Entropy (8bit):	4.852123311140593
Encrypted:	false
SSDEEP:
MD5:	8863D6AA55C7984B45C17A698A161FB8
SHA1:	0D93BEBE974241C73FCC56B8B05A5F639D971221
SHA-256:	5C76F8B25C8A1878BB7563C88954E80A3824C418CE6ED43B22DD028A73CEE1D8
SHA-512:	D58CE0B7983C0E5B3529CC96C42813EF82584A6B8E783E3FE6F3DE46DBADFDA96694B5876669DF8FC0B25BF13C20FFBA96FEE1CF88A674DBD058EBFF31900176
Malicious:	false
Reputation:	unknown
Preview:	......................>...................>...................................H.......d.......l...............................a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y.......................................................o......................................................................................................................................................................................................................."...6............................................................................................... ...!...-...#.......%...&...'...(...)...*...+...,......./...4...0...1...2...3...7...5...>...A...8...9...:...;...<...=.......?...@.......B...C...D...E...F...G...........J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSIAECE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1593014
Entropy (8bit):	6.726592394846319
Encrypted:	false
SSDEEP:
MD5:	538BD233B70A320A707D5DCBA9B95B80
SHA1:	6DE7E5DA38204EC6F4E04037E6BBB5A6F76044B1
SHA-256:	106DE3CC746D8D7E95F8C41CDED3332C09843FB8C16C7C75716FDF529C08482C
SHA-512:	C88BB6EE4C70231BC16489D1DCADD60F7B9D2C2677FD08C5E51F06C39489C61E89111712A4B53CD8B5F12F2C46E5A544A5163883A1AA139D7A7DB6158AE4C480
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.=vY.@.....@.....@.....@.....@.....@......&.{4338DD3D-C6E7-44F1-8FDD-8394E9076A9A}..OneStart PDF..PDFOneStartLive.msi.@.....@.....@.....@........&.{4CEC43B9-B497-4A5C-A703-63AB7ADA95E6}.....@.....@.....@.....@.......@.....@.....@.......@......OneStart PDF......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{FEE34822-BEE6-46CA-8BC7-812252175977}(.C:\Users\user\AppData\Local\OneStart.ai\.@.......@.....@.....@......&.{D8511B6D-3FAD-4D18-929C-23F5ACD99D44};.C:\Users\user\AppData\Local\OneStart.ai\OneStart Installer\.@.......@.....@.....@........CreateFolders..Creating folders..Folder: [1]".(.C:\Users\user\AppData\Local\OneStart.ai\.@....".;.C:\Users\user\AppData\Local\OneStart.ai\OneStart Installer\.@........AI_FdRollback..Rolling back downloaded files#.Rolling back downloaded file: "[1]"J...AI_FdRollback.@.-....h$..MZ......................@.....

C:\Windows\Installer\MSIAF0D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	795752
Entropy (8bit):	6.725813999920173
Encrypted:	false
SSDEEP:
MD5:	8D7DB54BD4DB23E5F8B8CFD791307E85
SHA1:	792B0B4B8C7062D1EB56656E3EE3330F728BC776
SHA-256:	8188B77BD8F60CD0B929EF70B71CD7E4F6D77E4F276A4E99723964B49CE0A4A8
SHA-512:	DFA2B900810573A82619B6E12C08F1490DB4A65342FC5881BB8AAFC1DB0D9E1EC75486B44F50D71CEE747C3A3F13C466047EE1A8D25D3C1927C04559EF372FD3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.!qg.O"g.O"g.O"..L#k.O"..J#.O"w+L#..O"w+K#v.O"w+J#1.O"..K#..O"..N#~.O"g.N"-.O"/F#..O"/O#f.O"/."f.O"g.."f.O"/M#f.O"Richg.O"........PE..L......f.........."!...).............................................................n....@A........................@n..D....o..........................h:... ..Xd......p...................@..........@...............d............................text...J........................... ..`.rdata..`...........................@..@.data....a...........j..............@....fptable.............\|..............@....rsrc................~..............@..@.reloc..Xd... ...f..................@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{4338DD3D-C6E7-44F1-8FDD-8394E9076A9A}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7702851794134112
Encrypted:	false
SSDEEP:
MD5:	F3E2F7D385FA853A9F971D38AEDF1FF7
SHA1:	65055FFC6B50F5D69E9F9B066D745DE0FC3EA5D0
SHA-256:	53210D04FC261DB1506AC333A713F02D238E26214E2AED19054552E70923A5F6
SHA-512:	618229445C2F892336A4CA0AC8F5FB5BE278ECBFF1ED2743A5B6C974F49B8753A8E979F5754B949BA16519E2914C68B26920E8B3D25D3AEE8FED29B500F2BEF5
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	454234
Entropy (8bit):	5.356169084382052
Encrypted:	false
SSDEEP:
MD5:	E56784D562785A57F62799E0CDA87E39
SHA1:	C777BBE876BADB9FCC034EAD96B13CF3B2F4BDEF
SHA-256:	75107CDAB9941BC88B46C4A538547AFECB83280AE81CEB596188384A99DA0226
SHA-512:	BC657B34863293AB19C9A06EA2C82E0ED2DCB18B0D2EE42EF4CEDE6061BA46E3251DB9FEFB658277BA6BE7F32706FBA3E9A90E3EC2438077BF7A95E5D6DBFCAF
Malicious:	false
Reputation:	unknown
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF11AC183C128ED82E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.266361508867706
Encrypted:	false
SSDEEP:
MD5:	A5B5E9D4D2D47717D0ADC6876D6C0E67
SHA1:	8A6DD49D6CF57D882C3166C8F9AEFA073F242F42
SHA-256:	9313D6B54571950B1F430E4AC9BE8994485C3B7AF590B4DD221797BBCB85528B
SHA-512:	53E46C93EEE4FA30CAF46BF517B764EB0B96192E2F7DE2C1A790C17C0EB4EAD1B8AC15D87EDEC37A56D69BB661C67649C2D10AAFC68A0D06183FA07FDA673745
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2FA0E2555BF0BFCF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07376586346076573
Encrypted:	false
SSDEEP:
MD5:	774D7E5F6A0735C5E78FC31D42BE59DC
SHA1:	312D0DFC55D6AF2F982413128092E12595E89F5A
SHA-256:	F90B2902923749882149DA11F6188B2A9EE8EE20CAFB478D7AD2BBF69D17F0CF
SHA-512:	2D26196484A7337ADBE572D0370EECD67A226AB2E88346C05F30DEAD64B9419C9819F329BAFEDEF5D0B6153E168E665F53AB41712D4DC8110319A1B39BA9DCA5
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA03EA6827901DCB2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEAC0A920A5203C37.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	0.1304596622935241
Encrypted:	false
SSDEEP:
MD5:	D9C8775C21FFFC0450769D0EDB243CDB
SHA1:	0341C91AF8371C4837ADC6F200666698A283CB8F
SHA-256:	A95A07E39828181C518757A12763DA0B804216BD426D84752FF1AE562D2B9909
SHA-512:	90E008353717AB4AF6D76A34623B6E027011F5C48C60290EE1ACF4C5A13160E52CE40C6196320112C3D04251C3069D92133CD85740687EDF214B8EDB77C44B26
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	13003
Entropy (8bit):	4.8480996369885005
Encrypted:	false
SSDEEP:
MD5:	B7A8A5E704496F4746EE267603464F80
SHA1:	DD4C5916888B4C121EAAE41BBCE51E36C0D8DFB4
SHA-256:	1BA9EE4CCBCB57880626BA7042EF99AB932006C7711FAD485A94B3AA092E6BF0
SHA-512:	9A07C21737FA64276115B37F93ADB92EBB103C6EB6A1D05D9BBD2779C7AF52D1F82E71B6A4A9166F5B77EB1DD1F4DED64D5547F0F49E42519C5911114DED2A43
Malicious:	false
Reputation:	unknown
URL:	https://pdfonestartlive.com/css/styles.css
Preview:	@import url("https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300..800;1,300..800&display=swap");.* {. -webkit-box-sizing: border-box;. box-sizing: border-box;. scroll-behavior: smooth;. scroll-margin-top: 50px;.}..body {. position: relative;. margin: 0;. font-family: "Open Sans", sans-serif;.}..body img {. width: 100%;.}...btn {. background: #26518E;. font-weight: 600;. display: inline-block;. text-decoration: none;. font-size: 27px;. padding: 20px 50px;. text-transform: uppercase;. -webkit-transition: .3s;. transition: .3s;. -webkit-box-shadow: 12px 12px 12px #00000029;. box-shadow: 12px 12px 12px #00000029;. font-weight: bold;. color: #fff;.}...btn:hover {. background: #ae2e2a;. -webkit-transition: .3s;. transition: .3s;.}../* HEADER */.header {. padding: 20px;. z-index: 9999;.}..header .header_container {. position: relative;. -webkit-box-sizing: border-box;. box-sizing: border-box;. display: -webkit-box;. display

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (312)
Category:	downloaded
Size (bytes):	7001
Entropy (8bit):	4.0827574985139785
Encrypted:	false
SSDEEP:
MD5:	D17EFD902C36554BA6FF62F8B4F7D508
SHA1:	237E07AE0AE9E02151498F7DED1AEBEB31743A0D
SHA-256:	E16D0999E239DBD70B2A09B282CECD3062A7456C41BDD1C2355EBA6603BA32B4
SHA-512:	F844E92E35BEDF8882C29ACF350766A4FFF5631EDD5ED4404843E1471F5E13B3C8C71CC6E20A0517597B054820EAE2B9D370DE711277C5BEFF1FE160701E9288
Malicious:	false
Reputation:	unknown
URL:	https://pdfonestartlive.com/
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <script type="text/javascript" src="https://app.termly.io/resource-blocker/d40656c8-6984-471f-86b4-ab55dfd095c3?autoBlock=on"></script>. <meta charset="UTF-8">. <meta name="description" content="Designed for everyone, especially those who work with PDFs regularly. Convert, edit, and organize your PDFs for free.no subscription needed.">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta name="robots" content="noindex, nofollow">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>PDF OneStart Live - Your Friendly PDF Companion</title>. <link rel="icon" type="image/x-icon" href="images/favicon.png">.. CSS -->. <link rel="stylesheet" href="css/styles.css">. <style>* {margin: 0;padding: 0;}</style>.</head>.<body>. <header>. <div class="header_container">. <div class="logo">. <img src="images/logo.png" alt="PDF One

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4838), with no line terminators
Category:	dropped
Size (bytes):	4838
Entropy (8bit):	5.802523272992787
Encrypted:	false
SSDEEP:
MD5:	2E6B8D4E70625034EC6210A5A97FDA74
SHA1:	F3687E9D1EAB233FBB831CAB473E01970C8C50E8
SHA-256:	A22273E2D54403B1D3A461E4F5DCB3C452030DC1BBF65ACA6ED925133B0ACD61
SHA-512:	20CEA66FBD4914AA4969D69CE2A1761A75D9A879825A970A816FAC988D3119D73894FF78B93CBD9FEA1CBE4AE0E7F44FE8E8DC8800CF7BD29AE3A67C8AF140F4
Malicious:	false
Reputation:	unknown
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(b,a,c){if(b==Array.prototype\|\|b==Object.prototype)return b;b[a]=c.value;return b};function k(b){b=["object"==typeof globalThis&&globalThis,b,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var a=0;a<b.length;++a){var c=b[a];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");} var m=k(this),n=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",q={},t={};function u(b,a,c){if(!c\|\|b!=null){c=t[a];if(c==null)return b[a];c=b[c];return c!==void 0?c:b[a]}} function v(b,a,c){if(a)a:{var d=b.split(".");b=d.length===1;var e=d[0],g;!b&&e in q?g=q:g=m;for(e=0;e<d.length-1;e++){var f=d[e];if(!(f in g))break a;g=g[f]}d=d[d.length-1];c=n&&c==="es6"?g[d]:null;a=a(c);a!=null&&(b?h(q,d,{configurable:!0,writable:!0,value:a}):a!==c&&(t[d]===void 0&&(b=Math.random()*1E9>>>0,t[d]=n?m.Symbol(d):"$jscp$"+b+"$"+d),h(g,t[d],{co

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1223)
Category:	downloaded
Size (bytes):	19485
Entropy (8bit):	5.498123677217319
Encrypted:	false
SSDEEP:
MD5:	ACFAAF3B7DA03D515C434409A8CEDFE3
SHA1:	4E2FE4950FCED5DF7A649497A093614E0A7D778F
SHA-256:	A192CC8B869A545B6910C7CB5C96612499A856C49585A67D1629CEC7EBB83DA0
SHA-512:	8F6D029D18C0AEFECC9F864A9DAA33E19D6F7B73E9CE6D4FABEEB7DABACE55764A7DE6771604B2E2CF59BCC5E3E12D076D508D9773EA14E6E1B2188F25184AE0
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/static/service_worker/4bj0/sw.js?origin=https%3A%2F%2Fpdfonestartlive.com
Preview:	'use strict';var aa=function(a){function c(d){return a.next(d)}function b(d){return a.throw(d)}return new Promise(function(d,e){function f(g){g.done?d(g.value):Promise.resolve(g.value).then(c,b).then(f,e)}f(a.next())})},h=function(a){return aa(a())};/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self;var r,u;a:{for(var ba=["CLOSURE_FLAGS"],z=n,A=0;A<ba.length;A++)if(z=z[ba[A]],z==null){u=null;break a}u=z}var ca=u&&u[610401301];r=ca!=null?ca:!1;var D;const da=n.navigator;D=da?da.userAgentData\|\|null:null;function F(a){return r?D?D.brands.some(({brand:c})=>c&&c.indexOf(a)!=-1):!1:!1}function G(a){var c;a:{const b=n.navigator;if(b){const d=b.userAgent;if(d){c=d;break a}}c=""}return c.indexOf(a)!=-1};function H(){return r?!!D&&D.brands.length>0:!1}function I(){return H()?F("Chromium"):(G("Chrome")\|\|G("CriOS"))&&!(H()?0:G("Edge"))\|\|G("Silk")};!G("Android")\|\|I();I();G("Safari")&&(I()\|\|(H()?0:G("Coast"))\|\|(H()?0:G("Opera"))\|\|(H()?0:G("Edge"))\|\|(

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1033 x 603, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	60240
Entropy (8bit):	7.9700723244514124
Encrypted:	false
SSDEEP:
MD5:	97B86A744AA5094A7364F80B8B4106CC
SHA1:	EACEEC417371BC2522F681BD364C161881F63127
SHA-256:	D52960CF5258D827E7778DCE0B674EE42EEF158AE6551D01F57989F367782658
SHA-512:	2D971AB798AEF1E15C8F5C93B4296F6DC8F44A3E36499FD02A8844E578948DA66FA350A42375A8BBADA7BB0C7401D1295ED655A6BFEEA6FDA2E7C3EFEA3959D4
Malicious:	false
Reputation:	unknown
URL:	https://pdfonestartlive.com/images/pic2.png
Preview:	.PNG........IHDR.......[......O=u....PLTE...7.<..FOV......>JR......G....s......................3JtUcj........................A.:...........L.......8.................1k....6..&.sa.CX.=.......;...]D....:o..............D..........xD3..2^......................$A.q...........@)............................[).............................9...............9l...2.... ;n:.....1p. ;s..........\F...6W..E..........bJ.aD.%F...).v.......Z@...<...................................@............)Br.6cH...+P....N.......}^....])...A_.... u.2{....,.\|AX.Pk.1L..nR...m..l...}.........x..X..........]t..............`....o<.e2}..Rg..]...yX.......8/u..rI........0.~t..f.H2.g..........<....x..............3Ffs....g\|..T<......).w.8N.....ZU[.c@^......u..F xi._h...XT.mM._M.ye...\.G....f......2tRNS......-.%..@..^+G..Vo_E..._...\|..........X...g...6v.....IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1023x574, components 3
Category:	downloaded
Size (bytes):	40435
Entropy (8bit):	7.262780823525723
Encrypted:	false
SSDEEP:
MD5:	8E08464E9F4721C08DB8B484718E8B45
SHA1:	065AF56E41910FC359605CD0A95C332F3BB8ED83
SHA-256:	BD2C404DE1030BE8C6C8B8FC1FF66E21AECD509F060056D17B31F3EDBB1A6E19
SHA-512:	0BE511623DBC343C2E1286708A539C8369D523C00503DB8422632F015447D794EC5F705A878A7DED0EB5E65515662F221F5C01FE7358BD6FD098E440EAA4585D
Malicious:	false
Reputation:	unknown
URL:	https://res.pdfonestartlive.com/ext/thankyou/download.jpg
Preview:	......Exif..II*.................Ducky.......d.....2http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 25.12 (Macintosh)" xmpMM:InstanceID="xmp.iid:D998DFBC9E7911EFBFA2D112F2FA53EA" xmpMM:DocumentID="xmp.did:D998DFBD9E7911EFBFA2D112F2FA53EA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D998DFBA9E7911EFBFA2D112F2FA53EA" stRef:documentID="xmp.did:D998DFBB9E7911EFBFA2D112F2FA53EA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..........................................................................................................................

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2310)
Category:	dropped
Size (bytes):	253442
Entropy (8bit):	5.552133375959234
Encrypted:	false
SSDEEP:
MD5:	7F89CA8DBAE879FA587D30A5DBCCB329
SHA1:	ACDCF5D9E1D89CF4B4F170553664F31045C099CE
SHA-256:	8A08B63DE3E0A1BEF95112E1F92B21C588DD237E81B47112BAECA58CB4D75B0A
SHA-512:	C115784E4F05B972E4BCCC4AEA507CB3B33C49E8515B217ECD90BACB4ADF6C3ACD426A9AAE7E0162FBB681D5575CBA5345C53CE17D6435E42720A82231C69FF9
Malicious:	false
Reputation:	unknown
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. ,[50,"__e",[46,"a"],[36,[13,[41,"$0"],[3,"$0",["require","internal.getEventData"]],["$0","event"]]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}.,."__e":{"2":true,"4":true}...}.,"blob":{"1":"1"}.,"permissions":{."__cid":{"read_container_data":{}}.,."__e":{"read_event_data":{"eventDataAccess":"specific","keyPatterns":["event"]}}...}....,"security_groups":{."google":[."__cid".,."__e"..]...}....};.....var h,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{d

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	216
Entropy (8bit):	5.144802221443789
Encrypted:	false
SSDEEP:
MD5:	E613FE51ED5D35022E5F6413C7276E94
SHA1:	ECF40CA1664935EC8B353D47396C6FFFE83908A7
SHA-256:	643B142F5D8F60AEEF48438A57D7453C17282054331C58E4B8DB570BF6771FD0
SHA-512:	25C5588A19335195E793E37B9EBF0497EF9598B32732EE6339D0E3A8FF74BDE780FD665FB88F6E55CB141DAD1C40910CCD088D348F0F350450AA61AB0D411CFD
Malicious:	false
Reputation:	unknown
URL:	https://pdfonestartlive.com/images/banner1.png
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /images/banner1.png was not found on this server.</p>.</body></html>.

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4820), with no line terminators
Category:	downloaded
Size (bytes):	4820
Entropy (8bit):	5.794324297822794
Encrypted:	false
SSDEEP:
MD5:	F435B5097D3F9CABA30D97AB60CBEB5C
SHA1:	58245329A2A198A3C66A57E078A822185CDF335D
SHA-256:	E9CF78C42763B6BC3126C8BFACA34827D410224182914355DC80BBC3626F9B41
SHA-512:	2CD758340CE902C3B915E13D7A739BAF0F16658CA3BF71C8ADAD5A0F3152FC1A1D98C7809A9FECA4C86081E8185C7C2C4098350A4BDF41726B95922C5686DBE5
Malicious:	false
Reputation:	unknown
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695098205/?random=1732279193027&cv=11&fst=1732279193027&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9119743904za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1280&u_h=1024&url=https%3A%2F%2Fpdfonestartlive.com%2Fdl%2Fthank-you%3Fcid%3D1oriUGWYY09kX670&ref=https%3A%2F%2Fpdfonestartlive.com%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1665010162.1732279193&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(b,a,c){if(b==Array.prototype\|\|b==Object.prototype)return b;b[a]=c.value;return b};function k(b){b=["object"==typeof globalThis&&globalThis,b,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var a=0;a<b.length;++a){var c=b[a];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");} var m=k(this),n=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",q={},t={};function u(b,a,c){if(!c\|\|b!=null){c=t[a];if(c==null)return b[a];c=b[c];return c!==void 0?c:b[a]}} function v(b,a,c){if(a)a:{var d=b.split(".");b=d.length===1;var e=d[0],g;!b&&e in q?g=q:g=m;for(e=0;e<d.length-1;e++){var f=d[e];if(!(f in g))break a;g=g[f]}d=d[d.length-1];c=n&&c==="es6"?g[d]:null;a=a(c);a!=null&&(b?h(q,d,{configurable:!0,writable:!0,value:a}):a!==c&&(t[d]===void 0&&(b=Math.random()*1E9>>>0,t[d]=n?m.Symbol(d):"$jscp$"+b+"$"+d),h(g,t[d],{co

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 500 x 159, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1349
Entropy (8bit):	7.436622218311567
Encrypted:	false
SSDEEP:
MD5:	84B7BB61400047C52E82662337C4F3BB
SHA1:	2711E09BFCD52277AEAAFBDD9DB6FE4A9FF2E1E1
SHA-256:	D53541781B3BBB7FAC1249D0C1E81A0B9FACCC0B805DF64881BFB4B33C39615F
SHA-512:	BF2C4D47082B2F18BEB07F461C9C45B8FD862E35B203059FB7441144E9350024A9BB51BBA3559D71B21063B43CF15155545917B05A57579246EC31B72F9858DD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............8L....2PLTE......LLL................................................................................mml...................................................20.RRR......rrr.........(&%......kkk.......................jdd<..E.................;..G..=..?.....'........B..~..i..N..2..+....................R................n.....EtRNS../....1.....................G6.............vj?+&.........\|k][[A/).&PH...}IDATx....J.@.....uI..t.t..........?.I.B..../.R..{`4.!.=..........=.:..R).......4ETj..H#.....P;.@....'.=.P..%q.$ul...P...*.Msaiz... .b-R^tSpn9F..>....II....lk...=.`..Hy.6..........KJuh.-...+T....$u....k.2.....R.p,.#..$O.0...m!......f.RK.._.s...)D.<..u.]5/....\8...n.U....pGJ6w.~KL...o..9/..7...:~2.w....#...at..........g....6...k.L.3:...>.9..0...nq..D...K..%...Bt.!...]B......@....@... .B...I..>$}H...!.C...I..>$}H...!.C...I..>$}H...!.C...I..>$}H..........A..t..N...:.t:.t...A..N...:.t:.t...A..N...:.t:.t...A..N...:.t:.t...A..N...:.t:.t...A..N...

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4443
Entropy (8bit):	7.918104770155148
Encrypted:	false
SSDEEP:
MD5:	0606ED9745742B9D09EAEFBDA8E923FD
SHA1:	D04F45AA4BAA5A9F2FF371F3049D52F6443268B0
SHA-256:	E2F50526653F93CC97CD628583E13A2C59C08D37311D8687FC56E6E42A7C091B
SHA-512:	DF97B57585F38CAB35E307A3A8A15EC1F61925C9D55BD3D10A384E267E402E60542AE14FD1BEE82122B96D56E9424A7B09C8778B36514453FEA0E7F41CF391F0
Malicious:	false
Reputation:	unknown
URL:	https://res.pdfonestartlive.com/ext/thankyou/icon-done.png
Preview:	.PNG........IHDR..............>a.....pHYs.........'.......tEXtSoftware.www.inkscape.org..<.....IDATx..{tT...3......@.c...Ex.C..R.....z.d...-/.w....xo{]......d2..0....Z....^-o..(.CHB......?B..{..yMr>..9..a..g....m...`.BZ.P..;....V2...G...J.d0..q....1L...bx...h.S....QE.J......)e.r.Z.]J0,..S.s..0.....l.f.....&...\|..O....b..P..4@..$...e...p/...I... .x..m:.m.k..L..`E.f..a....O.....6..3..o.w.g..MkA..{..Jlw...G.+!....u`.....u..@`.......`.PZ^. ...0Wk=ar.._l.h.........7.Q..y.O.Z.....W^H.....Ok1.....v.e.`.9.t..(....._.[S...Z...r.sf... \|Gk-.9H\..k)B3....~..y...V:4F.....3...-.hb.[.-...5\|...U.x..\|C.U5@.........F..7'....nR.H....b.t......V...9.X..p.T.0A.Bl%...>5?(.....R..j..h.....2..w Z.d9.W..uJ~@R....7D.....zL.2F.L{..Ox.x.Jd......D....{.......X.m..R/w...^n.(.8..N..........n.(g... .\|.d_.x...s.V0........r.).[@^i.._...F.+.1...thE.r.)....d..m/.f_.h..gy.^n..#.....Y...B...D?.\\|........[..{.....A../KM.....'qN..5`~-\..a.dwe..HM....b....8"g..p../..ES..HI

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1501
Entropy (8bit):	4.471995103256899
Encrypted:	false
SSDEEP:
MD5:	8D473218F46FBFBF9CF010F3C7E8222D
SHA1:	59775B964C3E896861756709FE7DE3649B88130B
SHA-256:	AB9EC22654AD6D0E31D9727610448C6470391401A4D05D3A063E3CBFA88EA3A6
SHA-512:	8B21E18356ABF5EF893DEEFE54E1D6726C7B40CD2124BC456D103A378BA1DCC6CC0C11EFAA3D42E982E15DD4A2C91E95142F491F3926ABF862A16C5C8A1C6E31
Malicious:	false
Reputation:	unknown
Preview:	try{. function createLink(text, url) {. var a = document.createElement('a');. a.href = url;. a.textContent = text; . a.target = '_blank';. return a;. }.. var pp = document.getElementsByClassName('pp-link');. if (pp != null) {. Array.from(pp).forEach(span => {. var originalText = span.textContent; . span.textContent = ''; . span.appendChild(createLink(originalText, 'https://pdfonestartlive.com/privacy.html')); . });. }. var tos = document.getElementsByClassName('tos-link');. if (tos != null) {. Array.from(tos).forEach(span => {. var originalText = span.textContent; . span.textContent = ''; . span.appendChild(createLink(originalText, 'https://pdfonestartlive.com/terms.html')); . });. }. var cs = document.getElementsByClassName('cu-link');. if (cs != null) {. Array.from(cs).forEach(span => {. var originalText = spa

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 832 x 832, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	30810
Entropy (8bit):	7.946060390505637
Encrypted:	false
SSDEEP:
MD5:	AA202F08808B47B39D33EC65762A40B5
SHA1:	EEC93B3E86DD290B4F7B60577EF877DBF2FD2F36
SHA-256:	E1E0A37D5CB88E2CC4F2519C271A9CB0B0F22CFA980F5B2F86D5479672153EF5
SHA-512:	B63FA8D8C4FC6F805EF56F5F1EE2F5DFC1F8C20DEF84045BECBDBDA02EFAC94789E4F9B3C7DF4753CB57D2A116EB150FD9CA716FC96BFCD26F3BCE5C9323E304
Malicious:	false
Reputation:	unknown
URL:	https://pdfonestartlive.com/images/pic5.png
Preview:	.PNG........IHDR...@...@.....5..p....PLTE...hdfc[`.........Z\............................\|tx.u\|.............................nn...............CCP...GIY....................nq......................N;>...ln.j........]a.z~..........Y`.....cY....RO..Y`.....Za...wv.......L1:......27MP19....X^......I1:.[b..........Y].[b.......wv.iq............X^....Y]....I3:.......cAIcY.....Z_RP.V4<.............s<D];AT<E......tx...ah...DL...RO.xu.`Z....ww....{....bi.jq.nv.u}.....F5;...N4<...tMT....Zc.......W[...cX..............XR.N7>...26K....X]...RQ..............vs............ng.....15U.........QN........s..]a.............ru................qi..wy.hl...bKR...TQ..}...17F...........z~...]f..........e\.^_..quBB}...f3=...PS.gOp...>:R....LS~r....LN..`.j...BtRNS.......... .....(GT1.E.?9U.ed.p..zx.~......j.c.u....P.......\I....t.IDATx...MN.A...n.......Cb..<C.'!....`..=..'.g.H3.yo[./.T*................................................YN.p..}1.v.

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (815)
Category:	downloaded
Size (bytes):	3501
Entropy (8bit):	5.383873370647921
Encrypted:	false
SSDEEP:
MD5:	147FD3B00C22BA9C939712E9213C24CA
SHA1:	3B48369B86FA0574F35379AACD1F42CC9C98A52B
SHA-256:	70F5B11C1870CF90201A6D5F770CA318A3FA5827C74A8765EDE22B487F7D4532
SHA-512:	E8419A71232EDAC8FD131446777F7D034B3171EFE07B3267479B439E4982650DB65A0D1DDC9F516315D5ED1B01ECFD2F7EB55D75D44AA51EE0AD494D441586D2
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/static/service_worker/4bj0/sw_iframe.html?origin=https%3A%2F%2Fpdfonestartlive.com
Preview:	<!DOCTYPE html>.<html>.<head>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body>. <script>.'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGERMath.random()))}}function n(a){return a.performance&&a.performance.now()\|\|Date.now()}.var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/.let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,crea

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	12137
Entropy (8bit):	5.339312592530427
Encrypted:	false
SSDEEP:
MD5:	CD9954F20B2EE6D34D999EB1A0A18FF4
SHA1:	8BE24AC9B73C0ABC59A2F618004A67C93ECD3D8E
SHA-256:	DCB72A8D2478BC448BAB6712DE33A8370C2B3027D9AE9A079D1F4DE5A6600634
SHA-512:	E999E129FC96C956C6918A553024ED77C487CDBFE985A587EB1750626F22FBB7442DCB7AB60BBD469E38A0492308ABEC5029818CB51BFBFA85B97D847F3C048A
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300..800;1,300..800&display=swap"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Open Sans';. font-style: italic;. font-weight: 300 800;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtE6F15M.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Open Sans';. font-style: italic;. font-weight: 300 800;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWvU6F15M.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext */.@font-face {. font-family: 'Open Sans';. font-style: italic;. font-weight: 300 800;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtU6F15M.woff2) format('woff2');. unicode-range: U+

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56792)
Category:	downloaded
Size (bytes):	514842
Entropy (8bit):	5.421674874567076
Encrypted:	false
SSDEEP:
MD5:	BC8BC01E030FBCA3F20833DDC586CEA1
SHA1:	1CC75DD30944AF49624EF35B338493938BAF13C6
SHA-256:	1B2FD9F3913A9189B543BC77C5F14A9CC12A4F9EDB0CABB924355074805BCFCB
SHA-512:	151FA5D099C3A593993D0900CF92D2F1D884AD67A7D5047E038810A6BE3E95862087A3444DFBC5B374D8439D1EFA955037D8563929239B358047F2D75B511588
Malicious:	false
Reputation:	unknown
URL:	https://app.termly.io/resource-blocker/d40656c8-6984-471f-86b4-ab55dfd095c3?autoBlock=on
Preview:	(function() {.const __TERMLY_CLIENT_INFO__ = {"continent_code":"NA","country_code2":"US","state":"New York"};...const __TERMLY_WEBSITE_CONFIG__ = {"enabled_frameworks":[],"website":{"uuid":"d40656c8-6984-471f-86b4-ab55dfd095c3","id":3568837,"name":"pdfonestartlive.com","over_consent_quota":false,"consents_count":0,"provisions":[{"id":null,"key":"allowed_policy_embed_options","type":"list","config":{"allowed_list":["html","embed","url"]},"data":{},"create_time":null,"update_time":null,"delete_time":null,"provision_set":{"resource_id":"d40656c8-6984-471f-86b4-ab55dfd095c3","resource_type":"website"}},{"id":null,"key":"allowed_scan_periods","type":"list","config":{"allowed_list":["weekly","monthly","trimonthly"]},"data":{},"create_time":null,"update_time":null,"delete_time":null,"provision_set":{"resource_id":"d40656c8-6984-471f-86b4-ab55dfd095c3","resource_type":"website"}},{"id":null,"key":"consent_quota","type":"count","config":{"period":"P1M","operation_count":-1},"data":{"current_per

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 743 x 598, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	37505
Entropy (8bit):	7.948504038783505
Encrypted:	false
SSDEEP:
MD5:	1C278A8CA5CDEFF2022F9914B7BFB649
SHA1:	F93561A5143563E4C04D06406FEAEDBE15B668BE
SHA-256:	7EBCA698BFC4D986A3BB71CEE40112DD2DEB6938DF1FE83C76CD9267219A87F8
SHA-512:	AC5046E25372E883ADED6A3824ED553F42370A27D77A3C3E6B7B03AD406B90A0B675A047281EA1F49E02AFF821A69F14F21EBB5D38171B2C5185EEA218CAE475
Malicious:	false
Reputation:	unknown
URL:	https://pdfonestartlive.com/images/pic4.png
Preview:	.PNG........IHDR.......V......O.....PLTE....#FFS....ijw....y.ddx...OJeCT\|................M_......................[Yp...............td...................r.....ux..............DS{.............@N.............o..o\|T=T.ept..FV.q.....'4..~}.~,=.......<L....O\.<N........bm..v.I`.....):;g.O..3A.Sf\|{..@Mt;N............................r....................v........t...y......+.\|......~........&-....._.........!,...........)............................~..............",.......I......./=..G......./B.z..#F....\|.......+....H....s..(D.......n...........~..w...'-....$/.z..u.c.....f......J....-D.j......y.3D...-.......ep.......v..$/..-....,............z.........8G\|~...EU.w.,=f\i....cp.!D..{..........JZ............BQ......e..my.......ht.8G.......j.............&X....e..._tRNS.,.......4..'.....U..i..QI}......>..=...4..........lw.o.....e.......r......................._.....IDATx...=o.@..q$..`.l..".,..{?.wB.`..$.......%.x.<...r}.RK..7..#}~.RH...?O.3DC.g

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 550 x 115, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3367
Entropy (8bit):	7.829469766195148
Encrypted:	false
SSDEEP:
MD5:	0F633E1E74FAA9731826E02B7CC2E4B8
SHA1:	755A54C72ECA42DB776182AE5A8E4284E74C4718
SHA-256:	FEAC7BC175E886F430C1C4258833C725A57A66318C4EFEB02EDD5E9B66B51D81
SHA-512:	233096E5035420A6D28D1E2C0049F336748827BEC6353D2615D4518E6142E3E38F99A330290E651A6FDDC1A8238D83127C15AB221050FDF0EA896B3E9D3DD4AD
Malicious:	false
Reputation:	unknown
URL:	https://pdfonestartlive.com/images/logo.png
Preview:	.PNG........IHDR...&...s.......9....}PLTE....&,.k..k..&,.k..k..k..k..~..k..k..DI.k..k..k..&,...&,.&,.&,.k..k..k..&,.&,....&,...&,..#.&,.hl....&,.'-.&,...............6;.hl.sw......%+.?A....HL.rq.....$..$.'-.-2.27.VZ.......w{.RQ.UY....~.........&,.k...$.......$!.... #.%(.nr..#.#!. ".""."!..#..#.........!".!!.!".#!....@E. ".#!..\a.17..................{..tw.hl.W[.PT.7=.)...#...................osw..f...ItRNS.DwDw..."..f3.....".U.U.$..f.3....Um..F.{xj2.....N..............jVU.a......IDATx...Y..P....:..-....8q..hL.qI..q_.v....+..+..O.gh....SB...!"""""""""""""""""""".o.W.."..Pu..P..=..W..Ug..$;..L..:!DU.<>.....s.3..},Ue..........c.2...B&.w...j=dR.P..".K..\..q..5.............o&.f..B......P;xdb+q..j..LN.I.........g..f.r...<0...9c&T. 3...N.[............=a&..4...~.L&....D.Y.t..8D#.,.{.1...Bq.scq..\..)..E..g~K{A.=.!.+qv.........N...i.aX..t<...#'.o._..I........./..(....)X..Y..p.^!3..a...Y3...G)D.av..%gM7.....Nu.....+..w...c...n&.?....J...`..

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (472)
Category:	downloaded
Size (bytes):	8001
Entropy (8bit):	4.2745498769231896
Encrypted:	false
SSDEEP:
MD5:	16EBAC6EC4820BC2D01AC8868F9B599E
SHA1:	6AB534BB1E23F91F57B10461054D338169CA525A
SHA-256:	395B7FEF1452C7BC18998AA81FFE32346E658B57AA03FBEAFB848187E6E5CF81
SHA-512:	DF21BEDC8F9314A61DAA65FDAE67DB6666B95977E7B1477ED8E68F48D5A14341AAA048FA4F699F0C6023491690AF15550313A6E9DA90BA6E3CCB801B02AE3B88
Malicious:	false
Reputation:	unknown
URL:	https://pdfonestartlive.com/dl/thank-you?cid=1oriUGWYY09kX670
Preview:	<!DOCTYPE html>.<html lang="en">..<head>. <script type='text/javascript' src='https://app.termly.io/resource-blocker/d40656c8-6984-471f-86b4-ab55dfd095c3?autoBlock=on'></script>. <meta charset="UTF-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta name="robots" content="noindex,nofollow">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title></title>. <link rel="icon" type="image/x-icon" href="https://res.pdfonestartlive.com/images/favicon.png">. <link rel="stylesheet" href="https://res.pdfonestartlive.com/ext/thankyou/style.css">. Google tag (gtag.js) --> <script async src='https://www.googletagmanager.com/gtag/js?id=AW-'695098205></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'AW-695098205'); </script>. Event snippet for onlineconv conversion page In your html page, add the snippet and call gtag_r

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 888 x 888, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	44379
Entropy (8bit):	7.9615440500012635
Encrypted:	false
SSDEEP:
MD5:	386DFF2D10D1B38618699A91EBFBEA57
SHA1:	3DEE2DE576F4719FE7154E2A40565FC75DA96E9C
SHA-256:	6746AAC424176A63A480AF4DACE6CE7236FE601A0A360B3D52A8D5A710AB403A
SHA-512:	97C720EB145BED4C83E88B22D79746C0D4BA7D6308ADDA7278E22073FB5ED650B8810CF1743FC6769A7C20E5FF2EEEF11ACB43D2FF48E2A2F8398DC65825EBFD
Malicious:	false
Reputation:	unknown
URL:	https://pdfonestartlive.com/images/pic3.png
Preview:	.PNG........IHDR...x...x........\|....PLTE...5F.fku..?9]7D.......cq}.y............y.tu..........9N...................1N..........{.....hz.Qi...rp........................................r..... "F..I.....G..I.....H..w.......'F....................{..t..G........."G........J.)>.......................F...........................G.....##...>........J.jp................(F..t..I.^.....wo....)?.,?..;I...H.$C....$F.w..7Fy...~o.;Q....!H....)>.pl..J..p.......p.........._f.Wf.hu....N......x.,@.5@.....p.%R........H....k.........f.....n.....a..o.....x...x..=vY.....O.s.....~...$G.....3O....~..xs....~...;<.....Yr.$F._f.............9H......ay..I........r.......J]....k......]r.+2..JW.k................Rs....gz..^_.............<e.......S..7M.e...~....oo?M.....a....?n....nPb.\|.'...)tRNS....*z(.d.:.].A..{.i..A..U...j...w..n.......IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3969)
Category:	dropped
Size (bytes):	291929
Entropy (8bit):	5.563215824213224
Encrypted:	false
SSDEEP:
MD5:	AEA6314BC5FDD222240B7A98CF4C9461
SHA1:	1E1C888D3CC1D151AA13974A1D342F175B2A12C6
SHA-256:	2A853F81D5BF665773CE07E300AC1525C9B74806C1B501593C05505CF86F108E
SHA-512:	721443D8C1E19FBF6C12C05F6420B1A435787393693A04C51B00CCC6EA523B3E3E67E740AF431AAFEDDC8FB9C9E89F1C6087CE1BCD72ADD45FA24F56129412FB
Malicious:	false
Reputation:	unknown
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-695098205","tag_id":10},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regi

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1158 x 798, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	105398
Entropy (8bit):	7.979409443090411
Encrypted:	false
SSDEEP:
MD5:	1EE02C064AEF81D8A516D84B714D1440
SHA1:	2F0BF34F2B960A562FE1CE8A574A85E5487C44F5
SHA-256:	D52452B219D8CAF2FF3627B762E3F53934808308DD5E696B97945EDE35CB44E1
SHA-512:	64C41214A7934BC92800DC35946BBB2DDBA38513EBC13B8098A9D77205E57F453CD27429B0C1F3F4A105F85F2FDD74FD0D9615E1C295A34C15F94FB9D3550C81
Malicious:	false
Reputation:	unknown
URL:	https://pdfonestartlive.com/images/pic1.png
Preview:	.PNG........IHDR............._.......PLTE......504.y}3,....gcgzuy...........HN.............G06@AT......cw.......v........g\|......2M}Ti.=Pw.Rc...cr.2Jv.^t.....................(P.....]u.......^xn...........................................'R.$S..............\y$R..........(O..............^u............._r.3M...#S.......++P.Ut....P..........._y.]n...fH\|.\r......Xn."S.........'R....m..............-O....[s...........Zs....0Q..M....+N..[x.6H...4M.....ct.....gz....(R...........f.........Zy...._x3P.....Zq.b.(Ew._y.........Vs.(L.Qe.._w!>i....cy...AG..e..b\|.%%...2I7Gw:T..6M...7M..*J..............%B.............h~x......;O.k...............bx...n....r........p...~......t..y...c...Rq..59.j.r..c.<Y.......:Q.....bt....&C...._......TG{.07....\n.Dd.....y.}...p.t..p.\|Y..B_.............&tRNS.7..8.'N......U.Mtw...\...m.......x....IDATx.........................................................................`v.a ..x.J...PQ.E.C]... ....w.,]...V.(.E.B&!...BI..

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3969)
Category:	downloaded
Size (bytes):	291929
Entropy (8bit):	5.563175673603061
Encrypted:	false
SSDEEP:
MD5:	95DE8EE4F09DD8088089FBEE6F5743F0
SHA1:	C335A7E1F1F05306AF23D32BF28AC879F021DE5B
SHA-256:	8EA4028BB51760E96FEC3825E60991AB51FC2E2B864BEA25FE85C5862FCF2E8E
SHA-512:	17105E776631B70CB004E2EC434295E43D9F6CE8F76F58943226429A6765872ACA849A4A2D09E7276EF2CD791FCE13679580E1B4BD0DC5397C1CC25D878AC56C
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=AW-695098205&l=dataLayer&cx=c&gtm=45be4bk0za200
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-695098205","tag_id":10},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regi

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	7989
Entropy (8bit):	4.747572087103069
Encrypted:	false
SSDEEP:
MD5:	C0E01BB159AF1A2D946E5077C940A858
SHA1:	F2B42D5AB4E045FEA52A354B139E45263E47FF01
SHA-256:	C8847D4ADE2C221E33B581F783552F3CD3EECAA43683E0F68DCBA203B13BAA2E
SHA-512:	6931317684DA91CB5AEF21B9F4439EE47E5B7A75802211E9EE3AE30C7389B5F0AF4B7BD281DA0639A1C9865867AAF6E1A05C4967BF4B8E487172C69F6A5DDD25
Malicious:	false
Reputation:	unknown
URL:	https://res.pdfonestartlive.com/ext/thankyou/style.css
Preview:	* {. margin: 0;. padding: 0;. box-sizing: border-box;. font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;.}..body.dl {. position: relative;.}..body.dl:before {. position: fixed;. top: -400px;. right: -400px;. content: '';. width: 60%;. height: 100%;. opacity: 0;. animation: pulse;. animation-duration: 2s;. animation-iteration-count: infinite;. background: radial-gradient(circle, rgba(145,219,61,1) 0%, transparent 55%);. z-index: 1;. border: 0px!important;. outline: 0!important;.}...download_link {. cursor: pointer;.}..@keyframes pulse {..0% {...transform: scale(0.2);. opacity: 1;..}...50% {...transform: scale(1);. opacity: 1;..}....100% {...transform: scale(0.2);. opacity: 1;..}.}../* SECOND PAGE */..second-page {. position: absolute;. top: 0;. left: 0;. width: 100%;. height: 100%;. background: #fff;..}

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1534
Entropy (8bit):	4.467162231095702
Encrypted:	false
SSDEEP:
MD5:	D0E56133E418EE791027781724981EF4
SHA1:	8F413CEE465E1DEDF64E4EDD0A96CC4EACB7FD41
SHA-256:	FFF848CFF0C781C5E3C287C4EFE903504FC1A24104006B1439D01BADE4BFFFCE
SHA-512:	985C47557B139D5899383F89FE60F6EC15D8A9C81FB12C3E277019AD3E0533670C90B1719B72DE4B5C0B6DDB125F9EF6DCBC7B66ED67F3068FB6322CD33B4686
Malicious:	false
Reputation:	unknown
URL:	https://pdfonestartlive.com/dl/overlay2.js
Preview:	(function(){. function updateCTAButton(){. var btnDownload = document.querySelectorAll('.download_link, .downloadBtn');. for (var i = 0; i < btnDownload.length; i++) {. btnDownload[i].onclick = function() {. location.href = '/dl/thank-you' + location.search; . }. }. }.. updateCTAButton();.. function updateLinks(){. try{. var links = Array.from(document.querySelectorAll('[role=link]'));. var cpList = links.filter(x=>x.innerText == 'Cookie Policy');. var ppList = links.filter(x=>x.innerText == 'Privacy Policy');. var cp = cpList.at(0);. var pp = ppList.at(0);. if(cp!=null && !cp.classList.contains('mod_elem')){. var clone = cp.cloneNode(true);. clone.onclick = function() { window.open('/cookiepolicy.html', '_blank');}. clone.classList.add('mod_elem');. cp.replaceWith(clone)

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Category:	downloaded
Size (bytes):	48236
Entropy (8bit):	7.994912604882335
Encrypted:	true
SSDEEP:
MD5:	015C126A3520C9A8F6A27979D0266E96
SHA1:	2ACF956561D44434A6D84204670CF849D3215D5F
SHA-256:	3C4D6A1421C7DDB7E404521FE8C4CD5BE5AF446D7689CD880BE26612EAAD3CFA
SHA-512:	02A20F2788BB1C3B2C7D3142C664CDEC306B6BA5366E57E33C008EDB3EB78638B98DC03CDF932A9DC440DED7827956F99117E7A3A4D55ACADD29B006032D9C5C
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Preview:	wOF2.......l......D...............................O..B..h?HVAR.x.`?STAT.$'...0+...\|.../V........+..2.0..6.6.$..`. ..~......[B4q.....t..P.M_.z...1..R.S...u.#..R....fR.1.N.v.N.P...;.2........!Z......Qs...5f.G.K.an2&....2.........C.H.t..N!.....nh.<(.vN.....j.._.L.P.t..Ai.%.............._I.i,..o,C.].H.X9.....a.=N....k.....n.L..k.f.u..{...:.}^\[..~5...Z`...........`!...%4..,...K0..&.a/....P....S....m.Z......u...D.j.F...f.0`I.`.`.h#..)(FQ.F!o$........S.).MV8%Rh...r...x...T]$.=......Y...!.3.&U..."....Q....{.l/0..d..4iJ/..}...3....i[Z..NG.WD...>.[U..Q.h..@m.=..S...1C2...d...<..v.?.q.f..n...OUz.....&Z......Z."..N.....n...9.B..C..W....}...W..6Zs.i.+Z........jB.n..x.8M.....q..@I....-.%..,C,..K..#.2...4)/.v_..x.<....t.....%[.4?.=j.V..jj''..W.u..q....I.L.=......E...\.M.7{.>......W........C.`...,9$......\..o........y...4A..m.P.,X..=?.:................wF`..+.P..........M!.4.......l.>M..t.ff5r..^..Z.g...!fA,hIIQ...e.R>B.AH.VuX..>..\.=.ky...1>C....>C.c.;...6D.

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 100 x 100, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1513
Entropy (8bit):	7.738720989144588
Encrypted:	false
SSDEEP:
MD5:	A0AE326C80E22CC214BDC24B537BE81F
SHA1:	B92CDCE903186385B8B315B1E9D80D155EC56C23
SHA-256:	D3ACFD20299E5C95496F4B0B0D2E3E3F55784EF907BECE3B2DA0CF4BAB161332
SHA-512:	9536365340AACF621DBAEAB110D27BA102B44CD9D4F764376D18042147963FFBD58F4E59014A619336644B3156A021EE5E2F411FA1BB1CCD3A6BCC70BD9ACDE5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...d...d.....G<ef....PLTE.......\|..KO...........#..#..#.JO.\|.........#..4.&,.>C.LP.@E....]a.dh........"$.$!.24.%+.',.#"..6.=B.?E.PM.QX..\|\|.cf.\|.....or..........................$...&,....$!.....$.!".....#.#!.w{............#..#. "."!."!."!.JO.!".#!.#!."!.$)..#. ". "....sw.'-..#..#..#. ".!!.... &..#.#!.....pt.UY.MR.9>..#..#."!...................}..im.fj.QU.?D.,2.%'..#.!". ".........`d.[_.06.%).................................\|..^b.]a/"&....6tRNS.........?.........kb.................tpoiiiXG71+K.9.....IDATh....r.@..aR ...{o'....!..:.j.^...N.qV.[+,$..2...+V7.,[4#.RK..m8..~..!gn.t.....Y.....f D...?.*...v....GH+."...!...(.O.).......>..e.%.<.v..U..j..'[d.60h.z...8.....q..z.`..?.u[..........f.AvBc.... s.7.w..4.Y..d...{..N....tK..E..Ko.AvS.c4F..iq.:...#...,.YN!.1...av..#..$.#. ...$."w$.. w..n.....w..C...2..#.f E..G..y.....F.Q..\|..z...\|..b..0..."......pf.K!9...b.(.......r..c$..I.QB..GQM.).+.3...r.Qd.1.jJ..Zr..F[..L..F.)DT@...-.R..\|

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2310)
Category:	downloaded
Size (bytes):	253442
Entropy (8bit):	5.552094335490989
Encrypted:	false
SSDEEP:
MD5:	A65F4975A4E002B04FCA2440D7631B16
SHA1:	7F0872DD65CA5D8A8535C5342B209C9B3C93FCF0
SHA-256:	A48FB33296D83E396DE786E8744FA98874934BCC7C40291AAE28F70D5EC40EC4
SHA-512:	F0851E14F41C22D86FA79D6500612B7239D723E4EB8E6885E3B48A9C25A8B6E406711B178FBFE8282544467C4A9208FE1114606D3FA5116B0790919D2A87BCBF
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=AW-
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. ,[50,"__e",[46,"a"],[36,[13,[41,"$0"],[3,"$0",["require","internal.getEventData"]],["$0","event"]]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}.,."__e":{"2":true,"4":true}...}.,"blob":{"1":"1"}.,"permissions":{."__cid":{"read_container_data":{}}.,."__e":{"read_event_data":{"eventDataAccess":"specific","keyPatterns":["event"]}}...}....,"security_groups":{."google":[."__cid".,."__e"..]...}....};.....var h,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{d

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	unknown
URL:	https://td.doubleclick.net/td/rul/695098205?random=1732279193027&cv=11&fst=1732279193027&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9119743904za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1280&u_h=1024&url=https%3A%2F%2Fpdfonestartlive.com%2Fdl%2Fthank-you%3Fcid%3D1oriUGWYY09kX670&ref=https%3A%2F%2Fpdfonestartlive.com%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1665010162.1732279193&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Preview:	<html></html>

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	518
Entropy (8bit):	4.906706660583561
Encrypted:	false
SSDEEP:
MD5:	A2D3E37C0E2A9A4511AE3E52B5ADE1E6
SHA1:	287EFEEAD023395361C8D3220C5233636B7743C4
SHA-256:	391E553330039EDFA947B0AED9D6909BB77865BCCC95242B7A95BB091BF6FBAE
SHA-512:	E2BEE238D543847B8D172B1B0D13A2C7DB7D16D473DA46853673AD8C81680A80C6E48569119827DC9D9A66C199A3DE6BC77548457952B902B34D1B2B41319B74
Malicious:	false
Reputation:	unknown
URL:	https://speedinovaton.com/0?cid=1oriUGWYY09kX670
Preview:	<!DOCTYPE html>..<html>.<head>. <meta name="referrer" content="always"> . <noscript>. <meta http-equiv="refresh" content="0;URL=https://speedinovaton.com:443/?cid=1oriUGWYY09kX670&id=0">. </noscript>.</head>.<body>...<script>...window.opener = null;. window.onload = function () {. setTimeout(function () { . location.replace("https://speedinovaton.com:443/?cid=1oriUGWYY09kX670&id=0"); . }, 500);...}..</script>.</body>.</html>

Static File Info

⊘No static file info

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://res.pdfonestartlive.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Config.Msi\60ac3b.rbs

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\OneStart.ai\OneStart Installer\onestart_installer.exe.part

C:\Users\user\AppData\Local\Temp\MSI96BE.tmp

C:\Users\user\AppData\Local\Temp\MSI983A.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\58e49132-abf8-44f8-9e4d-fd9b8d5351d3.tmp

C:\Users\user\Downloads\PDFOneStartLive.msi (copy)

C:\Users\user\Downloads\Unconfirmed 515313.crdownload (copy)

C:\Users\user\Downloads\Unconfirmed 579123.crdownload

C:\Users\user\Downloads\ce380c1a-6ad8-4ac2-b5c5-38ce040d38e0.tmp

C:\Windows\Installer\MSIAECE.tmp

C:\Windows\Installer\MSIAF0D.tmp

C:\Windows\Installer\SourceHash{4338DD3D-C6E7-44F1-8FDD-8394E9076A9A}

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF11AC183C128ED82E.TMP

C:\Windows\Temp\~DF2FA0E2555BF0BFCF.TMP

C:\Windows\Temp\~DFA03EA6827901DCB2.TMP

C:\Windows\Temp\~DFEAC0A920A5203C37.TMP

Chrome Cache Entry: 114

Windows Analysis Report
http://res.pdfonestartlive.com