Joe Sandbox Cloud Basic Analysis Report
Create Interactive Tour

Windows Analysis Report Hunt-Evil-Poster.pdf

Overview

General Information

Sample Name:Hunt-Evil-Poster.pdf
Analysis ID:533451
MD5:cd1db02476d6779c9e9a82a5a02313f7
SHA1:f8f70bf9dfeef7066104bca5857fada9c27c5f3d
SHA256:cb8fcb772489e84998bc8fec21a6575ddd0ae463d70ccfe232951d506495c746
Infos:

Most interesting Screenshot:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

No high impact signatures.

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • AcroRd32.exe (PID: 7108 cmdline: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Hunt-Evil-Poster.pdf MD5: B969CF0C7B2C443A99034881E8C8740A)
    • AcroRd32.exe (PID: 6172 cmdline: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 "C:\Users\user\Desktop\Hunt-Evil-Poster.pdf MD5: B969CF0C7B2C443A99034881E8C8740A)
    • RdrCEF.exe (PID: 1444 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 9AEBA3BACD721484391D15478A4080C7)
      • RdrCEF.exe (PID: 6564 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4711751990776589621 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4711751990776589621 --renderer-client-id=2 --mojo-platform-channel-handle=1708 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)
      • RdrCEF.exe (PID: 2944 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=3067853037477458632 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2 MD5: 9AEBA3BACD721484391D15478A4080C7)
      • RdrCEF.exe (PID: 6056 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=1326077866883068099 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1326077866883068099 --renderer-client-id=4 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)
      • RdrCEF.exe (PID: 4904 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=14440251597833857582 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14440251597833857582 --renderer-client-id=5 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

  • • Networking
  • • System Summary
  • • Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Hunt-Evil-Poster.pdfString found in binary or memory: http://www.color.org)/S/GTS_PDFX/Type/OutputIntent
Source: Hunt-Evil-Poster.pdfString found in binary or memory: http://www.npes.org/pdfx/ns/id/
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R1aarxzi_ioqrcu_4rg.tmpJump to behavior
Source: Hunt-Evil-Poster.pdfInitial sample: http://www.color.org
Source: classification engineClassification label: clean0.winPDF@13/48@0/1
Source: unknownProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Hunt-Evil-Poster.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 "C:\Users\user\Desktop\Hunt-Evil-Poster.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4711751990776589621 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4711751990776589621 --renderer-client-id=2 --mojo-platform-channel-handle=1708 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=3067853037477458632 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=1326077866883068099 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1326077866883068099 --renderer-client-id=4 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=14440251597833857582 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14440251597833857582 --renderer-client-id=5 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 "C:\Users\user\Desktop\Hunt-Evil-Poster.pdfJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4711751990776589621 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4711751990776589621 --renderer-client-id=2 --mojo-platform-channel-handle=1708 --allow-no-sandbox-job /prefetch:1Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=3067853037477458632 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=1326077866883068099 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1326077866883068099 --renderer-client-id=4 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job /prefetch:1Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=14440251597833857582 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14440251597833857582 --renderer-client-id=5 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeFile read: C:\Program Files (x86)\desktop.iniJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIconsJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeFile opened: C:\Windows\SysWOW64\Msftedit.dllJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Hunt-Evil-Poster.pdfInitial sample: PDF keyword /JS count = 0
Source: Hunt-Evil-Poster.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: Hunt-Evil-Poster.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: Hunt-Evil-Poster.pdfInitial sample: PDF keyword endobj count = 2884
Source: Hunt-Evil-Poster.pdfInitial sample: PDF keyword endstream count = 2001
Source: Hunt-Evil-Poster.pdfInitial sample: PDF keyword stream count = 2001
Source: Hunt-Evil-Poster.pdfInitial sample: PDF keyword obj count = 2884
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Spearphishing Link1Windows Management InstrumentationPath InterceptionProcess Injection1Masquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 533451 Sample: Hunt-Evil-Poster.pdf Startdate: 03/12/2021 Architecture: WINDOWS Score: 0 6 AcroRd32.exe 15 37 2->6         started        process3 8 RdrCEF.exe 69 6->8         started        11 AcroRd32.exe 8 10 6->11         started        dnsIp4 21 192.168.2.1 unknown unknown 8->21 13 RdrCEF.exe 8->13         started        15 RdrCEF.exe 8->15         started        17 RdrCEF.exe 8->17         started        19 RdrCEF.exe 8->19         started        process5

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Hunt-Evil-Poster.pdf0%ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.color.org)/S/GTS_PDFX/Type/OutputIntent0%Avira URL Cloudsafe
http://www.npes.org/pdfx/ns/id/0%URL Reputationsafe

Domains and IPs

Contacted Domains

No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://www.color.org)/S/GTS_PDFX/Type/OutputIntentHunt-Evil-Poster.pdffalse
  • Avira URL Cloud: safe
low
http://www.npes.org/pdfx/ns/id/Hunt-Evil-Poster.pdffalse
  • URL Reputation: safe
unknown

Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public

IPDomainCountryFlagASNASN NameMalicious

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:533451
Start date:03.12.2021
Start time:16:57:20
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 44s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:Hunt-Evil-Poster.pdf
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:21
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:CLEAN
Classification:clean0.winPDF@13/48@0/1
EGA Information:Failed
HDC Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Find and activate links
  • Close Viewer
Warnings:
  • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
  • Excluded IPs from analysis (whitelisted): 23.211.4.250, 80.67.82.97, 80.67.82.80
  • Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, store-images.s-microsoft.com, e4578.dscb.akamaiedge.net, acroipm2.adobe.com.edgesuite.net, a122.dscd.akamai.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com, acroipm2.adobe.com
  • Report size getting too big, too many NtSetInformationFile calls found.

Simulations

TimeTypeDescription
16:58:22API Interceptor14x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):205
Entropy (8bit):5.6215088276833445
Encrypted:false
SSDEEP:3:m+lvns8RzYOCGLvHkWBGKuKjXKLNjKLuV2gM0kZktewJiTFJrqzOJkvP5m1:men9YOFLvEWdM9QkteQi7Z+P41
MD5:7E8E5CABBDF018E3D79CD4328A92A9C9
SHA1:FCB7AB3B78F81EDCACBBBA7F42FF0C910CAC63DE
SHA-256:07110A11B095261FC707DC6365B580B6C85F4D9FE33ED20E51A9447187E0AF8F
SHA-512:BCE33767035DF70015E2ADD856BD339A9053303CEF58B0190EC25F4D7F09192872020E05D0E773B7BB85DCF78FB3FDE6766DB6B8BACACCCE35D2526F87BC9AD5
Malicious:false
Reputation:low
Preview: 0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js . ..C.0/....."#.D<....j.A.A..Eo......j?X.............d.{v.^.G...d.W.:...P..k%..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):174
Entropy (8bit):5.545372526069168
Encrypted:false
SSDEEP:3:m+lF9NX6v8RzYOCGLvHktWVKqzgten8Zkti/E98fZe/O+/rkwGhkg4m1:mi9NqEYOFLvEkT5btiQ8Be7Ywcr1
MD5:E99E80627FC4E12A899C5CE8850F4EA0
SHA1:A37FF7680B87B1F915BA39A5C57823E48E95B1A6
SHA-256:C55D8F4CE879D3FA987E9FC385849812ACD8D46D27E3B9F68EBE7D5FCC23352F
SHA-512:B66E209D98C23FE2D28D59F1933F67B77734EC76ADBFA31D5D9B031648FCC3E9CEAA4DDDEF8DE1E5AA973A87864DB07611752ABB18ED4DA0ED7C629390497549
Malicious:false
Reputation:low
Preview: 0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js .o_.C.0/....."#.D..G..j.A.A..Eo.........2.........1.x.'.vI..*|Z..o...+.4....0..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):246
Entropy (8bit):5.553417018242054
Encrypted:false
SSDEEP:6:mMyEYOFLvEWdVFLBKFjVFLBKFlQhuvXVa46tUgt/RlUoSjGY1:DyeRVFAFjVFAFzr6SgtZlUo6
MD5:73F9E829430B784D0BB9B1705295E8C1
SHA1:02737747EE4F5056787033ED7D0AB4C09BD7913F
SHA-256:8D6F13DCC324DABF3D44AEB89225FD87DE7BA3D18A3CD393C2B128523DF14BD1
SHA-512:443D80681F421791A31AF9051F5808E654DEB091300E8C55A4CDCA879B92E84C41415FF3DC38289CAC643B220664BA9370F1DCC0596D584A2597C1AE41C74497
Malicious:false
Reputation:low
Preview: 0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js . ..C.0/....."#.D.....j.A.A..Eo........^..........hvDO.N.t@.....n.*...... ....A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):232
Entropy (8bit):5.65213235727419
Encrypted:false
SSDEEP:6:mNtVYOFLvEWdFCi5RsPjoyqjttcbuiWulHyA1:IbRkiDujohsbjWus
MD5:595854807A7FFD93282AEB5F41DB73AC
SHA1:2DDBAD4E027DDEFA1981656E100F19EB7F79E463
SHA-256:B9194C0E0CAC508F9E1FD77E6AA7D58E648F1B4AAAD91D49DCE8E30ECCE429C4
SHA-512:7D6C49B6713767D5717EF964283FB8857B082301BD137D1A0BF87AA1B0A48CC10285FD5F25B730EC2F0D7EBEA8019E26C50F65265EF4B679B26EFEECC0A92F4D
Malicious:false
Reputation:low
Preview: 0\r..m......h.....'....._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-tool-view.js .*..C.0/....."#.D.M...j.A.A..Eo......vD}...........8 P..a...R..Y....7.@..2Dm{..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):210
Entropy (8bit):5.54151073114269
Encrypted:false
SSDEEP:6:m+yiXYOFLvEWd7VIGXVuA+bQtGVyh9PT41:pyixRuK+bQkV41T
MD5:5FEC6B1BE9A6F0521B1FF6B0AF5B9F56
SHA1:FE1001DF65037EE0657892520DB64F57B3B17D5B
SHA-256:1541CC314C5073A2A25E8A933E77E86DDD748042AA5A38C0F748F9D493F1721D
SHA-512:27D674540564668C0EC1CE67AB94D6E403C700A5F930B42840BF7CF82943062FC9983D5D6DD4E1B2DEFAB03E549F79E0CD692229C0982086CC118DE5C9606921
Malicious:false
Reputation:low
Preview: 0\r..m......R...kP]g...._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/selector.js ....C.0/....."#.D...j.A.A..Eo.................k.Q.....-_..y.....O...>..1....A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):216
Entropy (8bit):5.6378968630361275
Encrypted:false
SSDEEP:3:m+lifll08RzYOCGLvHkWBGKuKjXKoyNjXKLuVu0K//uTIvkZktZt5lYo2sZI8xe9:mvYOFLvEWdhwjQx0aWTKtZF3ZIl6P41
MD5:FD51AADA1B634CB0522E4CF4F31182F6
SHA1:26DED13BEDBE6F944BFF886BF18892DF5EF035C8
SHA-256:1B1E66878FE7EA8D68957A6948927A4334D61DC82B74B8786DE7A02446691A3A
SHA-512:69398348EF772CE6ECB30286DC65DC3D32C7D7AFF8F5945D3EC14642758A2799493536B5BBA5ACCC9EC31FF0A2B67BB7DBD20F5D29C570F4D63FB30D7BF316A8
Malicious:false
Preview: 0\r..m......X.....V....._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/plugin.js ..,.C.0/....."#.D.}..j.A.A..Eo......!q.`.........].>....uUf..N...k......c..l.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):209
Entropy (8bit):5.485970631774854
Encrypted:false
SSDEEP:3:m+lZd8RzYOCGLvHkWBGKuKjXKX7KoQRA/KVdKLuVYAVq/70fZktBtVcyxMtv9EWy:mJYOFLvEWdGQRQOdQv3tBjD6g1
MD5:5848B0526B624CE29AEC0DFF343C8D67
SHA1:2F2A699D827930DEFED09EF5F1A95CEB79F0D140
SHA-256:1CBA7D4D9C42873966EC7B2491179B9CB471011F87348EFB14C38A082CC39DDD
SHA-512:D2E42A546F60539F984F7265FCEBA072BF8A0FBC2FD8361DCB9415A8C5C5D4456C499C63CDD4E60E796F5D92969586780930460C87CA5EA627E19EACD11F1C2F
Malicious:false
Preview: 0\r..m......Q..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/plugin.js ....C.0/....."#.D.....j.A.A..Eo.......~.e..........c..y/L....|y.n..C/I.....X7-ne.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):179
Entropy (8bit):5.505405136137571
Encrypted:false
SSDEEP:3:m+lLp08RzYOCGLvHkfaMMuV8VqRwfZkt2kFQMWqg4nRb7om5m1:mOYOFLvECMLEiwSt2k+uR/41
MD5:F4141D15AD7909CF48E217D0936D219A
SHA1:6228E5DE018E25DEFE928B301A73DD71C2C3D403
SHA-256:BDCA6FB4C6ADD248B146BDAC8EE9C693B034FB6A771187E53C5FEA0B76190B5E
SHA-512:CB46725C0B5F5DF18B04B93D4216D50697B0528D0706633171073BE1ECD78DEA9398EF71357B826A96484056221742CC5A96A11538F2B9F057569F822B3A4DC3
Malicious:false
Preview: 0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js ..c.C.0/....."#.D..G..j.A.A..Eo........\..........y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):214
Entropy (8bit):5.520804483226741
Encrypted:false
SSDEEP:6:m4fPYOFLvEWdtu9C8X6tOpby0zBUKSAA1:pR0/X6Qpb
MD5:85D1F6F0CBF20BFB27D1EBEFD97207D1
SHA1:2589E5CC6413CB8F98993FD39DBE1CF960C0DCBB
SHA-256:6D25B981E93FB747F8513FA80B7087FAC7CC1E5189C9B074E22C05865135891D
SHA-512:F8CD2030BD6370B3285559002570980EF1D4932D205FBBC53D862759533881E6B1B0873D62558205A5A86224486CF3E67A23915FDC1257B3912E3A5DF1639CB8
Malicious:false
Preview: 0\r..m......V..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/search-summary/js/selector.js ....C.0/....."#.D.g...j.A.A..Eo......@5..........Q..E.=....=h`t..t..3%A.F$..w..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):177
Entropy (8bit):5.4737184701082935
Encrypted:false
SSDEEP:3:m+l64HXlA8RzYOCGLvHkjXMLOWFvfr8tne0fZkt3l/lWd1dn76KohyP5m1:md4HXXYOFLvEjMSWFvzr0St3lcjUdyPo
MD5:E155041C04FD4C50188546D58D4048C0
SHA1:5D44F566BCB121744DA8F13FC00C59C06A9851A5
SHA-256:8A0C8D7CC32B4E52EA0A1F3FB547CEE2915966CCF52864D859A83037ECAA22AD
SHA-512:A38DB44083B739EAFFB4785F1CB1E1290A6C5CDFD5F800CCDA57F527DD09D8E757E2051298FBD10188C66622B2D9B323EF367D6B85CDCE014BFD7D8F13DF819B
Malicious:false
Preview: 0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js ..a.C.0/....."#.D..G..j.A.A..Eo......o..,.........PU ....t^.....a.k..u.7.M.BW6#}..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):187
Entropy (8bit):5.566678942250967
Encrypted:false
SSDEEP:3:m+lpSUlIv8RzYOCGLvHkWBGKuK2fKVLiLxfqkZktzXRUPqf9tsDMaPV44m1:mkl9YOFLvEWsfOLGStziPqVyM+VY1
MD5:34C2011ECE4162465C7285415BD5C06D
SHA1:004BF390AFF56D0E2F99E57510C1B997C93B07DD
SHA-256:AA4FC4A26FBC5FE2C83A90E56AA27EFA9598EF15B85C1C7079353500C299E3D8
SHA-512:0124117892805429ECF7A302111C774F3F8FCF51D1D4CA2CD597986601B81E0EF213E512A54B64EE84D9E9C9D5A03571910E26BA92B3FC6324DBAB7C0987A76F
Malicious:false
Preview: 0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js ....C.0/....."#.D<.n..j.A.A..Eo.......*R...........q.O...j....._y..L^z...?..@N..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):244
Entropy (8bit):5.588739516031345
Encrypted:false
SSDEEP:6:mt9YOFLvEWdVFLBKFjVFLBKFlyulqtxfgtwSeKaT9pr1:URVFAFjVFAFrlqfgtwSeKaTL
MD5:290486DD7DA72EE7D284F6C1EBCF1905
SHA1:1FF4062D71C4FED09A1192598CC1CE65FBF72F15
SHA-256:2CCA5C2D39DEB0CBC7601430DFEF16186F54954965C182C371559B899D8D2234
SHA-512:C45EB25DB23DE7A66F5FB4299D67930DEF47993BA0FC45229931137D61DDB5935EBA4A0A4687A14CA1DBB498FBECCED9E2E558554853546F899A3E7A82D014EC
Malicious:false
Preview: 0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js .o..C.0/....."#.D.....j.A.A..Eo.........P..............H...{...2../.k`..r4.C. .A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):211
Entropy (8bit):5.508945017306275
Encrypted:false
SSDEEP:3:m+lx4F08RzYOCGLvHkWBGKuKjXKGBIEGdevA/KPWFvpb0/V/XHZktf/tjyrpYFm1:ms2VYOFLvEWdvBIEGdeXuL0lKtf/g11
MD5:3D733968AE5D75CABF97B7D5F7BCB6EF
SHA1:2FCFC61B7E325F9AD1066A8348E2A5CCF7825378
SHA-256:E79BC5E3395901EC5E3E1DAE4F858ACC52636676D0A2D85CAA6CCE79671DDD16
SHA-512:D8A289F25F8782F1084442949FC1B25BAD59CC22F5838834687B128864DD290E2DA0A324CBC04D07CF6D05A464E37CA8721E305DFC6EAC4B366FE531FD723EEB
Malicious:false
Preview: 0\r..m......S...]......._keyhttps://rna-resource.acrobat.com/static/js/plugins/add-account/js/selector.js ..g.C.0/....."#.D.....j.A.A..Eo......K............A.o]@r..Q.....<w.....].n\....A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):202
Entropy (8bit):5.635533380100546
Encrypted:false
SSDEEP:6:maVYOFLvEWdwAPCQ3gr6tDxm7OhKlvA1:RbR16Br6BxmJ
MD5:686EEB9328D94375F28DC4C3FA91CFCC
SHA1:2BB109CB265800DE0DB066D989788E1FD495281F
SHA-256:C98C7CA74D32E00A833EC1B0DDD89C2021C140CF8668EE188695276DA5F42FA4
SHA-512:FD2B761C694265A235513480ED9D496125ECCF3AFA539EBFBC3ECCC4B82A4B83A847D870EA3988DC27260591ED3E1E41990878F793B5AB0DFA52D7AFB0F09181
Malicious:false
Preview: 0\r..m......J......{...._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/plugin.js ..(.C.0/....."#.D.{}..j.A.A..Eo....................4T].....Tw.....(..b...EO....9.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):211
Entropy (8bit):5.518820315694583
Encrypted:false
SSDEEP:6:ms2gEYOFLvEWdGQRQVuGbzggQmbtkdFt1:B2geRHRQZ/Q4
MD5:4B37966A3A98BDBD9FCE611A6BCE4EB4
SHA1:8C40B009E89486B59163BD53D78D3FBA8E0F3A5F
SHA-256:2E1FE5544828E3BAD6B06DD818FC0A85101D9C87C2A572E03C8C88AB461625D3
SHA-512:B9F7D876A582EC15FC5E65EA4C4B0092C92100D2087259EA38F097C9317E995B290FFCA6F163F89D03095FC5048D981CF17A699E20C81307C2A4A7906F360260
Malicious:false
Preview: 0\r..m......S...W.%z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/selector.js .of.C.0/....."#.D.u...j.A.A..Eo.......t-........@..{o]...9o|..qY....T....{..u.b..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):206
Entropy (8bit):5.538567511701119
Encrypted:false
SSDEEP:3:m+lerlyv8RzYOCGLvHkWBGKuKjXKX+IAHKLuV7NbltFuiGZktAAX4EnNWQ1SUm1:mzyEYOFLvEWdrIOQglhtGEt1S/1
MD5:E97A642B6C22A0B36779A4B30C43A6AB
SHA1:5DF600AF3A2CCB60389F2D4634F7DBB54A09A0C8
SHA-256:45ADE49800B073E6F3D6088A0462FB0189845DB946C6949EE4D26A3F5A0B7F0A
SHA-512:D1B24631074E4573BACFA2CEAB26DB4C9E5441E18EE724EDBE57BF5A7319695FF2048C0631F627B43332F536F331AB1776356FB80ADE3667953508FD35F99DBF
Malicious:false
Preview: 0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js ....C.0/....."#.D.Kv..j.A.A..Eo.......'...........t\a......x5.'OuE.C..@......x..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):218
Entropy (8bit):5.570237511250574
Encrypted:false
SSDEEP:3:m+lKcv8RzYOCGLvHkWBGKuKjXKoyNH/KPWFv5kUiE9kZkt13glwJNqww6U+5m1:mnYOFLvEWdhwyuTkFE9t1QlwrqwK+41
MD5:404A58EBBD223EDD9F014C1B2059E872
SHA1:B577774E6AB7534E83AFAFA6725F56BCF18A57C7
SHA-256:9082CCFBC2E9FC96A5E5AAC77C8004D580F3885D9A8F0BE8EC2D3BDE3E13CE5B
SHA-512:33A9C75B5058B2C48F319597B3AC368D6BA001F19EE84843CED21D79BF6E3B91F0A5014E02B497C57FF13A9AB1245B0559B257880072DCBA0960BAF0C90A31D9
Malicious:false
Preview: 0\r..m......Z.........._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/selector.js ....C.0/....."#.D.Q}..j.A.A..Eo......n.wd...............7...o..a=.98I......(3.$G.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):230
Entropy (8bit):5.559502104832947
Encrypted:false
SSDEEP:6:mYXYOFLvEWdrROk/RJbuA4OQX6tcQfO441:/RrROk/dDQX6CQfL
MD5:43C287D0A9435277667E06EF954C3E56
SHA1:31356CAEAE436A405B6C67BED53E66A1C782732B
SHA-256:645FE0C1ACA6B97E0EB2C0C687A3BF7740E5FB06A68D04900A272516F662D076
SHA-512:D92CF6604D59626F60CCA2EB634BD6B06E4E1574AB70E8DCED2445A329A1A6A2644C302D830EAA4657A7D49B076BF765566E8FC257CE6AC0339D6D8D68E7B310
Malicious:false
Preview: 0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ....C.0/....."#.D..u..j.A.A..Eo.........[..........~..rw.+[....!.)?..f.U..(=.=.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):186
Entropy (8bit):5.53098901139336
Encrypted:false
SSDEEP:3:m+lhD4ll08RzYOCGLvHkWBGKuKdTSVEYVKX5ikZktIXzoIN1OFPL4m1:mmDEYOFLvEWXIEYVptyzV1QPLr1
MD5:908B760CA4B14AC9F8CF0C3BD0A7A9D4
SHA1:C23B34A16B8FE55394B2086240CCEDA3132CC60E
SHA-256:A69820573048985E06EDCEF8D0EAEA890A0E632A070AB29DE2B318FA8B1AB424
SHA-512:F9E6EECC9AFCFB62723B10BC2844C1F1E67FFAA75FCAA611D01F505EC80BA12E2E30E5E0500BAC47F57EE6EC44B0AEE290286372436DAE603DDB66505B042334
Malicious:false
Preview: 0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ....C.0/....."#.Dk.n..j.A.A..Eo......<............~]...%s..<...n.f..<.....1#..U..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):207
Entropy (8bit):5.5876558790903275
Encrypted:false
SSDEEP:3:m+l+nq1A8RzYOCGLvHkWBGKuKjXKLNfKPWFvY5a/eVtZktalU8D6EsEJeUm1:m52YOFLvEWdMAuy0mGtuUEvsEJ41
MD5:5F36836FE85BCCD807E0D13010666EE1
SHA1:0DCE787B07BD9CE116D2C09B438A5C360BC6FE3C
SHA-256:26D145EB70C7152B6FC1CD106FE7E6C6230376C15FB978A8B9ECE390BB9D1EF8
SHA-512:BAB3B31B80E44CE553E434AE2DD641D9181E2AC8209E7342138020F93D6636328E2161A7E0B9D2DF95F3527AD9C1B570FC35C265877CB44005F7FBE9DE4D9A76
Malicious:false
Preview: 0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js .g..C.0/....."#.D.0...j.A.A..Eo.......!............z._a...'.v.......4p3..1.']...A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):210
Entropy (8bit):5.539299333777404
Encrypted:false
SSDEEP:3:m+lf1UldA8RzYOCGLvHkWBGKuKjXK9QXAdWKfKPWFvgbzV+l/NGHZktJVltwFoDU:mYilPYOFLvEWd8CAdAu+bzgU6tWong1
MD5:0AB8A4A4E16881B4E0EA71391827132A
SHA1:64350A02540FF5A1D81B3206DB93208A75C6F1CD
SHA-256:47C9B9DD6BF5A76959B8511B23EF5B9F0A21B354C3CD97CD54F471E4C14A1BC1
SHA-512:C12429365ED028246306F8BE3344B749B4FEE1D7DF8E9C490A3D5C88E94B482004A684C4458B3347D4CC7963C8DED281D5D98CEE7033CC37B59DDF992D287BA0
Malicious:false
Preview: 0\r..m......R....|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js ....C.0/....."#.D.c...j.A.A..Eo.......n>:........c}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):223
Entropy (8bit):5.587372818417134
Encrypted:false
SSDEEP:6:mY8nYOFLvEWdrROk/IuNpIbtQXDN16wG1:F8hRrROk/pKOX5
MD5:6EBE0158DA099485B04824530EF614C6
SHA1:46EE204055E3661B835DB979AB263BEB206FE307
SHA-256:BFD7F744B1D567000E02D5D12F173F3E57E52B9B1105505751A54F3A04F4DD7E
SHA-512:2A4537F135B8A902DDDB66733DB2E1874CA3D2D381FBA9E0A21B6B1F1A218DE7D013F746C4157A3BAEA9D41537A0D50904299661E372BEDA1BA0A1FAE7EE3C6F
Malicious:false
Preview: 0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js ....C.0/....."#.D.u..j.A.A..Eo...................%.k.SZ..~W.....:)'B..ad......A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):213
Entropy (8bit):5.6254692976493965
Encrypted:false
SSDEEP:3:m+lstxt08RzYOCGLvHkWBGKuKjXKX+IAuAJVKjXKLuV6KgtWGGZktAllePmJelcz:mLrnYOFLvEWdrIoJUQB/LtAQeJIi1
MD5:73629E60642B99DEE757315D19C7DE8C
SHA1:6CA46E267870D3B7B0FDC528760CFD5D153DABD6
SHA-256:4E47700B3A51D5078BDDD9805A9B365E73BC5D711B444F9DD8A1BB152C643834
SHA-512:FB9776AD6207C9E265AE871CB75CE9BD955C9662DF4B73D47657BB0AFF5625B2C33D6BA4BCC0F38C4D56017DA3BDCC6CF178635F41FD1DAB115D37D7797AEBBA
Malicious:false
Preview: 0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js ..!.C.0/....."#.D#.v..j.A.A..Eo...................;"./N_.,.:C..2....9L.H...3:...A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):208
Entropy (8bit):5.516107861992476
Encrypted:false
SSDEEP:6:mOEYOFLvEWdrIhuRB9AQO9tU5zgm2d/1:0RzABi5R
MD5:8CB930B077D333EE65DBDD0A1CB36C90
SHA1:948BF2984D3AA4609892DEFE8CFE11111638C26F
SHA-256:42C2398A13C47FC58BA2F2EF8375EA2456D5401E7D9F6B0AEC0950A0B52D7491
SHA-512:A9D1D9CF6E6F47FB3B46EA5926C55EAD451E05584BD82496FFC0AA6C41595CA24707199658C2C5327A54616219AA85157C46E9DBBC04B918722F864E649DB5B9
Malicious:false
Preview: 0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js ....C.0/....."#.D.eu..j.A.A..Eo.......<6{........Z.Z}Q..4.o....0+..[|..n:*..U.W.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):188
Entropy (8bit):5.581028438107125
Encrypted:false
SSDEEP:3:m+l8UElLA8RzYOCGLvHkWBGKuKPK7Cv6K//0JF0kZkt4HWBiaQ562HvpMm1:mAElVYOFLvEW1KNK/MJ6t4HDx56uvp1
MD5:AA7D420F4E85D9CDE9F393F08ADEDEDD
SHA1:418BF0ECD0437EF7A4D3D2B6143A02C6F6A247E1
SHA-256:009223AE1EB3BDD2F38FA11F5590DD6819961F06182C642E6A212646528247F7
SHA-512:A724B5CE9658E2E4B51B7DCA79F32126B82922185D496721C46B9E8FD32F74ACA1BBCB3A4B802898E0778F2F852680E82DA4AABBFD252AD980456987A4446F3C
Malicious:false
Preview: 0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js ..}.C.0/....."#.D.Y..j.A.A..Eo........B8........z?...SwC...^..y.....V..7R-O.....A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):214
Entropy (8bit):5.629252155297999
Encrypted:false
SSDEEP:3:m+lSy/08RzYOCGLvHkWBGKuKjXKBRSJvBCv1KPWFvijl/8kZktSg/ldY8UDLY3Pr:mWYOFLvEWdBJvvuawthtTUDLYtmOZn1
MD5:6514CF532D703453AB54D8597202DE62
SHA1:F4FDDFE0F511721202098C07E70E3F95A3024362
SHA-256:21EA3B0390DCFB2A963A5B2E86E24543B39376EF73B73AD90399D0D67377A5F9
SHA-512:EF610BC16E83542C57BA359FA3A4CF5D69F938F4C14A86481311DD6BFFA83D740B0E838717637E499360C882DC5636FC41F12EBBF6FDC5B1D057D0A79268018E
Malicious:false
Preview: 0\r..m......V.....h....._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/selector.js ..y.C.0/....."#.D....j.A.A..Eo.........]............t.q..W.EZ....1...[.zC.7mD..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):211
Entropy (8bit):5.5717984748834235
Encrypted:false
SSDEEP:3:m+lxCq//6v8RzYOCGLvHkWBGKuKCH6U4LJzWHK7WFv9XCVkGZktwl/llnpSKGoS6:msRPYOFLvEWIa7zp7gSO9tQ/lt8VPu1
MD5:82C1CD102F985AE4E3044BFE4D71CBA9
SHA1:BE52B5D169447BA257130E1BC2CA4AB9193CDB0F
SHA-256:648C80FBDB9CD7AE1C9D8955DDFA524C0F276E54007A2D0CA0A2D4EAE2E9F256
SHA-512:AC6BC85D2CDF375F1D4B6039236B23BEA397728FADE90CB2EB8F42E8F3591972134B047CABDD41864C4D7ECD7DC584CD52208BF0E775F628FFEE841C9D26ABA3
Malicious:false
Preview: 0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js ..q.C.0/....."#.D..G..j.A.A..Eo.......-.............L...Im.@.........E.nW...IP..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):208
Entropy (8bit):5.570538090096388
Encrypted:false
SSDEEP:3:m+lQi9lC8RzYOCGLvHkWBGKuKjXKVRNUpXKLuVZz//yfZktp+/n6F4XVAZ+8cV3I:mKPYOFLvEWdENU9QUptp+/6wiM3Y1
MD5:641F326F82B78C7B4D21F4C9C1271A7D
SHA1:4CEFA8AFF858C9DEA540699B3EE5CB6CD873B5E1
SHA-256:863BF30E8AE39B1AA9EE261AE58235C3572F453218CCD6F4129DA40A531B73B7
SHA-512:25D027F1995312D1876E0D4B05B2E458ECB10CCA2E1F2345C2E693AFA726C5C629B000F69125DBE2A6A54E6C60435976CE115A2CB776612481DC952968A98D67
Malicious:false
Preview: 0\r..m......P...Yft....._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/plugin.js ..*.C.0/....."#.Dt....j.A.A..Eo......3.Y............M....m+lS..e.....<7.U.P8*.0K.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):208
Entropy (8bit):5.604174928665375
Encrypted:false
SSDEEP:6:mQt6EYOFLvEWdccAHQu209Qtn//wjBRCh/41:XRc9ObZwDi/
MD5:27CC72AB2B664E132CF21EB07AB2EA75
SHA1:C4305668D72B512AE39082FEF92ECEDC75E3F104
SHA-256:D28B4DCFD53DD8FF07545EF996C0C6E6FCB8C02CC643907EB2A79DE88120679C
SHA-512:6951932DBC69EE4B46999B8FA6C6104B16FA0EB43C61ECEE4F83841468161FA1152CD1E2D89A2D41A59F2ECA64A3E3751D6F0853258BAD751C702B2E6E166153
Malicious:false
Preview: 0\r..m......P...W3......_keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/plugin.js ....C.0/....."#.D....j.A.A..Eo.......f6q........PJm...0x.x..RD...BB!@5..<..]....A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):231
Entropy (8bit):5.551975285946463
Encrypted:false
SSDEEP:6:mqs6XYOFLvEWdFCi5mhu8ijt7kULlF4r1:bs6xRkifj17LlF4
MD5:2BD1529B378669E787836FB271062AD6
SHA1:5094FAC77F64D5973B52A09A118FC9A69C1AED60
SHA-256:F48034099F1D54D6A6C88E27C3470402FFCAA0A8CB2BF432463F79475D85452D
SHA-512:6FAE7FA232E87C07592382D55DE382B2596FC518FD0D7296D733DF8176E2008A80D4296A31A1E33E9EA019E27F8CE3A5DC3224086852F15BEF6645E8614515ED
Malicious:false
Preview: 0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js .}G.C.0/....."#.DCt...j.A.A..Eo........a.........P...#4..l....5...5..).w.. .h.~..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):215
Entropy (8bit):5.4861415655014945
Encrypted:false
SSDEEP:3:m+lPHYs8RzYOCGLvHkWBGKuKjXKXqjuSKPWFvCbdyRFkGZktHPECcu1isLK5m1:mhYOFLvEWd/aFu/6tvEN941
MD5:F9DD9FCFED2BF0C920AA12EA3AA2056F
SHA1:C9D06DA8A643A70B0A901C396DA7EC86F60FD5E8
SHA-256:110BD365A0FC054079187617D9E8064DFFE40E908F0F82A5EDCE1DA5388A6629
SHA-512:1ADB1B4388A78287BFE08C8CF7C4E00358E3FC09740F85B3D0750D3F82DC62579E61DE9ADB334D909AB3065A9DA49E8ACBE2C095795047313801DF203E9242EF
Malicious:false
Preview: 0\r..m......W....w.m...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-recent-files/js/selector.js .'..C.0/....."#.D.....j.A.A..Eo.......a8............a.f.m.i.o.p..3U5.....^...I.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):208
Entropy (8bit):5.519179229886115
Encrypted:false
SSDEEP:6:mR9YOFLvEWd7VIGXOdQz6t1BMqVd3G4K41:2DRuR+6LB9Vd2
MD5:D5C99CA1C8998B586C1AA1A140EC9956
SHA1:D138B54D8BA58132B219A7EFF94E843A7BC59DB0
SHA-256:6FD5BD4C20632637F67A737FC4C14662982B22DF19ECF2E8D1AB145AA9EAAFDD
SHA-512:911FAA57707A44E23A0AEA14CF3AA203D706E9D366AB6547BCD1D9F8D8802C528859387883B2580FD5E5BD48A9CA646604BCB5420728510F07E70406DC0E5F79
Malicious:false
Preview: 0\r..m......P...y.p....._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/plugin.js ....C.0/....."#.D.....j.A.A..Eo.........8..........y.$..$.v5j...T...z.]..._S....A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):208
Entropy (8bit):5.596312082399033
Encrypted:false
SSDEEP:6:mkqYOFLvEWd8CAd9QW9QtpHllduA424r1:+RQjQPHEr
MD5:40BC3D04BB127747591B3135E7D228EB
SHA1:6961D2B985C96A435235FD68E613BA131453ED92
SHA-256:9257F881A0AC607E20CB9DDA6B35A5B5C040CE0742291B116086AC8FD48FA7EA
SHA-512:8E5973DE0884F2E2E110C2FD33652E4C8CCA28DAC7A77469BF9EC2C0D1F5B18E2D0C225D08102C78F7EA18722E7F474AEC2DEBC13E10F086FE909B871DB6C168
Malicious:false
Preview: 0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js ....C.0/....."#.DM....j.A.A..Eo.......}.........#..@..k(v.8g..5.~_....]Pj.*..6.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):210
Entropy (8bit):5.558952008360135
Encrypted:false
SSDEEP:3:m+lS5Etla8RzYOCGLvHkWBGKuKjXKVRNUp/KPWFvKX6ZwikZktoj//NAg2iHio/1:moXXYOFLvEWdENUAuwqztu//GyC8n1
MD5:C2B799A30B66DDF016FFE5A7CDB33C8D
SHA1:56B0C51157A87F8ECE93DBBF4B38DBE0CCF95C13
SHA-256:9598C693082B6C65FF1B2A27BA246F490AA06A5EA0B3CAEB94505F1D64D0440C
SHA-512:1DB7FC84013C4E9886B001582AAA85B2CAF7F3CED4B901AB2D551DD5DCE5C30471E2C09ADEAB52D361477FAAF26700786EC32EAF23E5CDD0CE38E2EFEB395B9B
Malicious:false
Preview: 0\r..m......R..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/selector.js ...C.0/....."#.D.<}..j.A.A..Eo.................8.../...;.\\o....1..........+..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):221
Entropy (8bit):5.578443361743929
Encrypted:false
SSDEEP:3:m+lFNrs8RzYOCGLvHkWBGKuKjXKeRKVIJ/2kKLuVxLaUGZktAN1sYWmYk5m1:mQZYOFLvEWdrROk/VQNgtisLmB41
MD5:922C7C7F125E8A1206BD53E8610E4003
SHA1:9E5B1743D8FBB08C6A8400857D6489E8274CFFAC
SHA-256:5EC63B9CBB16178B3F35CD0F8770C790B7F6659579EA6FED48A8133BC98F2EBC
SHA-512:7005D0B79F667B3665FAE56958215130714635B4480590DFCA794961D91210A07F63DD4D44B1E5ABF628B4F4787D346F26CFFF59F8A6316AB4459252C42ED709
Malicious:false
Preview: 0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js ..I.C.0/....."#.D..v..j.A.A..Eo......eM.>........ ./.ev......N~..6.b.....$.j;:C...A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):210
Entropy (8bit):5.578158694938063
Encrypted:false
SSDEEP:3:m+lUV/la8RzYOCGLvHkWBGKuKjXKjcAW6KPWFvXb8l/JXZktVb1Xrobk9mZa6toj:mZ/lXYOFLvEWdccAWuR0RKt55dm9741
MD5:7F58D623A01F8A1CE0C1265EF9EE393F
SHA1:EB6BB8BA57CFE76E66C027B79A1E80AFA68D9AF6
SHA-256:ACD8A389F5E750F9BB5D6AC133D539FCC105F87FDFF0BE57F8FF82D7C6605679
SHA-512:7A947EAAC62BE9087929CD5FA94B27450C045478806492D7168CD6DDE9EAF44730A99D7F87F84FE053943FD72650349A9BCCA01C3D66C51AD2976A6292B96FE0
Malicious:false
Preview: 0\r..m......R...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/selector.js ..G.C.0/....."#.DG:...j.A.A..Eo........=4...........U...I.>P...X...x..0U.~;m.x.k.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):204
Entropy (8bit):5.556120323524062
Encrypted:false
SSDEEP:3:m+lUg18RzYOCGLvHkWBGKuKjXKrAUWiKPWFvYCqCVk9kZkt682B6shoq+Nem1:mMOYOFLvEWdwAPVudO9t+B6Jn1
MD5:975D7A6AD2402DE29CECA23F1E418B73
SHA1:B2E2B6A45C3FD06329CAC1B93144A24687256CE2
SHA-256:B97EF88CDA9914CCB97A1392AF04BB4903A68FE5B49867BDB91C6D0ED2F9CE3B
SHA-512:12F5B52321891A483991C6710BD7D5D0CA97DF28A08BA935AD892350F6584569E48B5795EF530158066D415AEF7AEB67FB7ACBA2C6AF82410906448E04A63439
Malicious:false
Preview: 0\r..m......L....Ey....._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/selector.js ....C.0/....."#.D6.}..j.A.A..Eo......C ..............k....F..D..O.n;[.1m.....=..A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):212
Entropy (8bit):5.601565324404942
Encrypted:false
SSDEEP:3:m+lUDflllla8RzYOCGLvHkWBGKuKjXKBRSJvBCvlKLuVt/0fZktYltAN/hcfsBXo:m3PXYOFLvEWdBJvYQwtYXqhcsBXIh1
MD5:0E61D4AA3F00BAA3EECD40C6DF7123E4
SHA1:DE815C7E793A39885F8012503E1561F6ECDF2D0E
SHA-256:4EC5C6D52F67CD442EBAAEB20245BB47F294237A3EDF5F3CFFC54CF1E9F25F68
SHA-512:BBD373AD2B6E19373B80D930A823BA18F06A089C1D7E10973B60F8A1ED3FC70AF30CA4C2C35EF4CC3E6F0DBD0860EB033CEB00A6EE880A1A288A5CB4108ECF25
Malicious:false
Preview: 0\r..m......T......z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/plugin.js ....C.0/....."#.D.!...j.A.A..Eo........F............k..`..N3.... ..d..$[.....{.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):228
Entropy (8bit):5.592712726622499
Encrypted:false
SSDEEP:6:msPYOFLvEWdrROk/RJUQ3K6StUrc3Me/1:3RrROk/swKpCr
MD5:B20583E2F0E1D0A2449AE24F021B7A2D
SHA1:F4215850A0C0662A82F0991C7E1EC7943468E3C5
SHA-256:04EC9C3E3A4042A289433452E5C18934FA5CA925AEE84E5444D1D4B45249D4D5
SHA-512:371F9658B5E7A795BBEB2AD8E84897B60413866BA79A2DAE4E59267DDDE58EF2ECB8C0A8DC79DB66FB41F614F4489A7504B4572A4A69E78B3ED0CB539FA35A25
Malicious:false
Preview: 0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js ..M.C.0/....."#.D.\w..j.A.A..Eo.........~.............9Q].8O.z....=..:.N.{....N{.A..Eo..................
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:Maple help database
Category:modified
Size (bytes):1032
Entropy (8bit):5.129850939647014
Encrypted:false
SSDEEP:24:qTKOomMSyVDSVuNqCOgiX9DjpqyqN0YrowArpiTygBa:q2Bm8SVuNqCOgiX9DjpqyqGYrodrpiTc
MD5:8AD9C75975F22721F2277653D3CBDEE8
SHA1:4CB640A1180166C6DA0DB495E7CB13E6D65D4A27
SHA-256:89AD7DDD0C3A48E4E14305DADA2ACCEF193F93B16580701DC2A6AE21EA7EF810
SHA-512:0634AFEB9B865215E0CA730B2D9B51CDC1B8AEEAA48231FA66D3C2DC043DB491F303E67325B400976C9B39D000355BE3C73C2F3A390532038939D72024FD7848
Malicious:false
Preview: .....9L8oy retne....)........T............3......C.0/..........v...q..@..C.0/..........C..M.....k...............#...(...k.............]...I..C.0/..................C.0/...........6<|...@..C.0/.........<...W..J@..C.0/..............oB*@..C.0/...........a....@..C.0/...........;.y~A.@..C.0/...........P....V@..C.0/.........F..=z;.@..C.0/.............o.@..C.0/...........*..@..C.0/...........2q....@..C.0/.........Gy.'.h.@..C.0/.............k7A.@..C.0/.........:..N.A..@..C.0/..........;/.....C.0/...................C.0/............P[. q...C.0/.........,+..._.#...C.0/..........J..j......C.0/.........A?.2:.....C.0/..............q....C.0/..........u\]..q...C.0/.........!...0.o...C.0/...........*.......C.0/..........o..k.....C.0/..........&.S......C.0/.........^.~..z....C.0/..........[.i..%....C.0/..........+.{..'...C.0/..........@..x...C.0/............MV3.....C.0/.........*)....J:...C.0/.........+.U.!..V...C.0/.............D.4....C.0/..........~.,.4>...C.0/.........
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:Maple help database
Category:dropped
Size (bytes):1032
Entropy (8bit):5.129850939647014
Encrypted:false
SSDEEP:24:qTKOomMSyVDSVuNqCOgiX9DjpqyqN0YrowArpiTygBa:q2Bm8SVuNqCOgiX9DjpqyqGYrodrpiTc
MD5:8AD9C75975F22721F2277653D3CBDEE8
SHA1:4CB640A1180166C6DA0DB495E7CB13E6D65D4A27
SHA-256:89AD7DDD0C3A48E4E14305DADA2ACCEF193F93B16580701DC2A6AE21EA7EF810
SHA-512:0634AFEB9B865215E0CA730B2D9B51CDC1B8AEEAA48231FA66D3C2DC043DB491F303E67325B400976C9B39D000355BE3C73C2F3A390532038939D72024FD7848
Malicious:false
Preview: .....9L8oy retne....)........T............3......C.0/..........v...q..@..C.0/..........C..M.....k...............#...(...k.............]...I..C.0/..................C.0/...........6<|...@..C.0/.........<...W..J@..C.0/..............oB*@..C.0/...........a....@..C.0/...........;.y~A.@..C.0/...........P....V@..C.0/.........F..=z;.@..C.0/.............o.@..C.0/...........*..@..C.0/...........2q....@..C.0/.........Gy.'.h.@..C.0/.............k7A.@..C.0/.........:..N.A..@..C.0/..........;/.....C.0/...................C.0/............P[. q...C.0/.........,+..._.#...C.0/..........J..j......C.0/.........A?.2:.....C.0/..............q....C.0/..........u\]..q...C.0/.........!...0.o...C.0/...........*.......C.0/..........o..k.....C.0/..........&.S......C.0/.........^.~..z....C.0/..........[.i..%....C.0/..........+.{..'...C.0/..........@..x...C.0/............MV3.....C.0/.........*)....J:...C.0/.........+.U.!..V...C.0/.............D.4....C.0/..........~.,.4>...C.0/.........
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):289
Entropy (8bit):5.202228673122362
Encrypted:false
SSDEEP:6:mn4QgFlOq2Pwkn2nKuAl9OmbnIFUtO4QVRZmwI4QvLkwOwkn2nKuAl9OmbjLJ:AdAwvYfHAahFUtOdVR/IdT5JfHAaSJ
MD5:60C6061ACBAF80DDC69E30970006B5FC
SHA1:492E18DB41D800D05A8416B227B2A6A46679B034
SHA-256:810236A0BE93BE1D3C8B2B011A409925FB2CE612A8DE3271352877C4E175C438
SHA-512:D87AA3397639C15766A95C037F47D99F4BC7285B695611C9F76C370C2A89825B163EA3DE6898354949D0615DE17F414B4D8237BFBE6ED43E93A667B214FE4122
Malicious:false
Preview: 2021/12/03-16:58:26.576 b20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2021/12/03-16:58:26.580 b20 Recovering log #3.2021/12/03-16:58:26.582 b20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):289
Entropy (8bit):5.202228673122362
Encrypted:false
SSDEEP:6:mn4QgFlOq2Pwkn2nKuAl9OmbnIFUtO4QVRZmwI4QvLkwOwkn2nKuAl9OmbjLJ:AdAwvYfHAahFUtOdVR/IdT5JfHAaSJ
MD5:60C6061ACBAF80DDC69E30970006B5FC
SHA1:492E18DB41D800D05A8416B227B2A6A46679B034
SHA-256:810236A0BE93BE1D3C8B2B011A409925FB2CE612A8DE3271352877C4E175C438
SHA-512:D87AA3397639C15766A95C037F47D99F4BC7285B695611C9F76C370C2A89825B163EA3DE6898354949D0615DE17F414B4D8237BFBE6ED43E93A667B214FE4122
Malicious:false
Preview: 2021/12/03-16:58:26.576 b20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2021/12/03-16:58:26.580 b20 Recovering log #3.2021/12/03-16:58:26.582 b20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:data
Category:dropped
Size (bytes):131072
Entropy (8bit):0.008907738108328683
Encrypted:false
SSDEEP:3:ImtV/CuttMTLS/Jf0lt+urQTlD7vt/lcvmllP62/X:IiV1kTLLlousTxvv6m
MD5:0A339004BCB425813505AE2871E61E20
SHA1:9BDA040B5589E1B919A259DB212F4CE8E32AAA8F
SHA-256:46828E139BE167C9E36B556EB137571DE93A29930C366CE0666B1385BC106517
SHA-512:DA3CE56FFA0538D022A80F7F6DAE1E89586E27FC484E82CCCAADC9EE163BEBBEDA2CAB446D507C622BAE868086E382F5436E328418BB877FBBF0A2192CB61DF8
Malicious:false
Preview: VLnk.....?......).0k.....................................................................................................................................................................................................................................................U....n.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-211203172336Z-253.bmp
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:PC bitmap, Windows 3.x format, 106 x -152 x 32
Category:dropped
Size (bytes):64502
Entropy (8bit):4.990364333956131
Encrypted:false
SSDEEP:768:ArKWoy/p6+vsLS6tOBd0Jth+QnWCRchyVYV3LgiZvX/:ArKWoip3vsLS6tOH0th+QnuhEYJ/
MD5:9A21FA789D205A96F1D61207D4C0EC20
SHA1:30B9ECAAEB83B0363AA052C36FD1A0544ACA6AB0
SHA-256:3E5367B22795EC2BA31E4757ABE0310F67580FD769818B0C83AC9AAB9FBEFABF
SHA-512:4128D84CA3111B5976E91535595E6971E6EC7B88420EDB7B3A11983508ECAD1C72E7CE11D442B150982C89447366EB0FD5F1CA2CC064DC2672BE0021CCE8EF4B
Malicious:false
Preview: BM........6...(...j...h..... .........................}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..iO5.pQ).}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..tU6.tU6.nTH.nTH.nTH.nTH.xV...k6..d&..k6..k6......rI..d&.}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..}W..oV@..}......[f..]Vd.}W..}W..}W..}W..}W..}W..}W
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:SQLite 3.x database, last written using SQLite version 3024000
Category:dropped
Size (bytes):61440
Entropy (8bit):3.568397314712987
Encrypted:false
SSDEEP:384:XeT9dThftELJ8fwRRwZsLRGlKhsvXh+vSc:MkYZsLQhUSc
MD5:C62955C0FA541A3625FB9CD08A710D64
SHA1:88B4CF1F3CF49509FBDE5CBB1EF84F47E1820B8C
SHA-256:D888DD6760854BCD7263956079D662D0DB39531FD267F6DB81682D74FF43D149
SHA-512:8983ABBC07C78F490DD2C72B07250A51ECE3ACCD6DFF0291A917D6AEA273EE9699A107D3443467823D9466E244482250FC730E04FF9369DD3326DB6100D7BD25
Malicious:false
Preview: SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:SQLite Rollback Journal
Category:modified
Size (bytes):8720
Entropy (8bit):3.316149773185579
Encrypted:false
SSDEEP:48:7Me2iomVQYom1CPiom8Vom1Nom1Aiom1RROiom1Com1pom1/iomVKiom5JqQlmFs:7kCgPOhzCKgN49IVXEBodRBks
MD5:F72E47B1EA7A6381D04824FD62796A42
SHA1:924CACDE546F5B29756FE903AE992AABB92627A0
SHA-256:9A6A52D074C27309C2EAA85792644D907034BDBEDAFEE23C59EEF615BC181980
SHA-512:46C88BF66788B43A63A1DEF332840E5C4C1F744F321C25C84524878B727D39D126ABAF082649CBF524D408884F28F24BD3214C474309F7E1CC3F42B620B022A3
Malicious:false
Preview: .... .c.....MS]...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................W....<.W.L...y.......~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin
Process:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:data
Category:dropped
Size (bytes):63598
Entropy (8bit):5.4331110334817385
Encrypted:false
SSDEEP:768:PCbGNFYGpiyVFiC0ZTLmtlJkGhkBWtZYhLcy9I6Yyu:J0GpiyVFihTLmzJk7hgyu6K
MD5:BB7B6C42ED0422F78543378385CDFAD3
SHA1:2CD4048D21DC1ECA6502362DC7E905D61A6EDECF
SHA-256:2EED0839E4E492E44CB27B2BFEB182A8582AB93C166636ACB3756A9F061AA4F5
SHA-512:14283A5EF10D278F69CF8B54533820404DD752D9D64C7B8E14FF42C28A6935FA1ED68884DF464E66E3005D827C380F2753F662FA286F09CF002B84883F26F7D6
Malicious:false
Preview: 4.382.88.FID.2:o:........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.94.FID.2:o:........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.82.FID.2:o:........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.93.FID.2:o:........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.107.FID.2:o:........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.103.FID.2:o:........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.116.FID.2:o:........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.75.FID.2:o:........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.89.FID.2:o:........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.85.FID.2:o:........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.98.FID.2:o:........:F:Arial-B

Static File Info

General

File type:PDF document, version 1.6
Entropy (8bit):7.864099682119433
TrID:
  • Adobe Portable Document Format (5005/1) 100.00%
File name:Hunt-Evil-Poster.pdf
File size:2928851
MD5:cd1db02476d6779c9e9a82a5a02313f7
SHA1:f8f70bf9dfeef7066104bca5857fada9c27c5f3d
SHA256:cb8fcb772489e84998bc8fec21a6575ddd0ae463d70ccfe232951d506495c746
SHA512:2e8e87524be24219bded3a161ab25a2e2e15febc751efe298b2acff0ecb560885009dc19962b70c749d94359ee6c26f4e30916b4024f9b6cbde93617fbbdb67a
SSDEEP:49152:ZVqkPT3/w+cHH8vgPzpVpzPO4rXVpzPOi:2KT3wn84Fz24rrz2i
File Content Preview:%PDF-1.6.%......623 0 obj.<</Linearized 1/L 2928851/O 626/E 1697645/N 2/T 2916275/H [ 45536 3433]>>.endobj. .xref..623 2262..0000000016 00000 n..0000048969 00000 n..0000049284 00000 n..0000049413 00000 n..0000086634 00000 n..0000087069 00000 n..000

File Icon

Icon Hash:74ecccdcd4ccccf0

Static PDF Info

General

Header:%PDF-1.6
Total Entropy:7.864100
Total Bytes:2928851
Stream Entropy:7.976480
Stream Bytes:2443810
Entropy outside Streams:0.000000
Bytes outside Streams:485041
Number of EOF found:2
Bytes after EOF:
NameCount
obj2884
endobj2884
stream2001
endstream2001
xref2
trailer2
startxref2
/Page2
/Encrypt0
/ObjStm0
/URI0
/JS0
/JavaScript0
/AA0
/OpenAction0
/AcroForm1
/JBIG2Decode0
/RichMedia0
/Launch0
/EmbeddedFile0

Image Streams

IDDHASHMD5Preview
1178c3d1d1d1c1c38a804ee81cf8fe404760c4913a856332bb83
117971ceb62b2286cc549536211bf5268046a08eb57f260423fa
118010288542281042854ea8ccf49068d31a42f744a9b54c862b
118300000000000000008a88c1af20ef593a12c4bc9cb3b95620
11840000000000000000b3a2fdb28f60e7b42cc3aeb1987e9443

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

  • • File
  • • Registry

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: AcroRd32.exe PID: 7108 Parent PID: 5376

Function Logs

General

Start time:16:58:14
Start date:03/12/2021
Path:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):true
Commandline:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Hunt-Evil-Poster.pdf
Imagebase:0x1170000
File size:2571312 bytes
MD5 hash:B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:moderate
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

Timing Activities

Show Windows behavior

Windows UI Activities

Show Windows behavior

Network Activities

Show Windows behavior

Object Security Activities

Show Windows behavior

LPC Port Activities

Analysis Process: AcroRd32.exe PID: 6172 Parent PID: 7108

Function Logs

General

Start time:16:58:14
Start date:03/12/2021
Path:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):true
Commandline:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 "C:\Users\user\Desktop\Hunt-Evil-Poster.pdf
Imagebase:0x1170000
File size:2571312 bytes
MD5 hash:B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:false
Has administrator privileges:false
Programmed in:C, C++ or other language
Reputation:moderate
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

Timing Activities

Show Windows behavior

Windows UI Activities

Show Windows behavior

Object Security Activities

Show Windows behavior

LPC Port Activities

Analysis Process: RdrCEF.exe PID: 1444 Parent PID: 7108

Function Logs

General

Start time:16:58:21
Start date:03/12/2021
Path:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):true
Commandline:"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:0x370000
File size:9475120 bytes
MD5 hash:9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:moderate
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

Timing Activities

Show Windows behavior

Windows UI Activities

Show Windows behavior

Object Security Activities

Show Windows behavior

LPC Port Activities

Analysis Process: RdrCEF.exe PID: 6564 Parent PID: 1444

Function Logs

General

Start time:16:58:22
Start date:03/12/2021
Path:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):true
Commandline:"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4711751990776589621 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4711751990776589621 --renderer-client-id=2 --mojo-platform-channel-handle=1708 --allow-no-sandbox-job /prefetch:1
Imagebase:0x370000
File size:9475120 bytes
MD5 hash:9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:false
Has administrator privileges:false
Programmed in:C, C++ or other language
Reputation:moderate
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

LPC Port Activities

Analysis Process: RdrCEF.exe PID: 2944 Parent PID: 1444

Function Logs

General

Start time:16:58:22
Start date:03/12/2021
Path:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):true
Commandline:"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=3067853037477458632 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
Imagebase:0x370000
File size:9475120 bytes
MD5 hash:9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:false
Has administrator privileges:false
Programmed in:C, C++ or other language
Reputation:moderate
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

Timing Activities

Show Windows behavior

Windows UI Activities

Show Windows behavior

LPC Port Activities

Analysis Process: RdrCEF.exe PID: 6056 Parent PID: 1444

Function Logs

General

Start time:16:58:23
Start date:03/12/2021
Path:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):true
Commandline:"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=1326077866883068099 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1326077866883068099 --renderer-client-id=4 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job /prefetch:1
Imagebase:0x370000
File size:9475120 bytes
MD5 hash:9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:false
Has administrator privileges:false
Programmed in:C, C++ or other language
Reputation:moderate
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

LPC Port Activities

Analysis Process: RdrCEF.exe PID: 4904 Parent PID: 1444

Function Logs

General

Start time:16:58:42
Start date:03/12/2021
Path:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):true
Commandline:"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1716,11972420933289763406,2529516767643149623,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=14440251597833857582 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14440251597833857582 --renderer-client-id=5 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
Imagebase:0x370000
File size:9475120 bytes
MD5 hash:9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:false
Has administrator privileges:false
Programmed in:C, C++ or other language
Reputation:moderate
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

LPC Port Activities

Disassembly

Code Analysis