Edit tour

Windows Analysis Report
Mar_02_Contract_12.pdf

Overview

General Information

Sample Name:	Mar_02_Contract_12.pdf
Analysis ID:	818958
MD5:	0e672cfd6083d74fb5a0be79346a52db
SHA1:	9a66963325418ece8dee9630fee84291f83361e7
SHA256:	56734da861a7d95f690e0172e717cc933513e37677c18c9277a2a261e55090ac
Tags:	pdf
Infos:

Detection

Qbot Downloader

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Qbot Downloader

C2 URLs / IPs found in malware configuration

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

AcroRd32.exe (PID: 4356 cmdline: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Mar_02_Contract_12.pdf MD5: B969CF0C7B2C443A99034881E8C8740A)

RdrCEF.exe (PID: 5908 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 9AEBA3BACD721484391D15478A4080C7)

chrome.exe (PID: 1112 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

conhost.exe (PID: 2108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 2100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 --field-trial-handle=1880,i,15371601189275763345,10103813945144653960,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

unarchiver.exe (PID: 6928 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Mar_02_Contract_19.zip MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 7004 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\m1vyocb5.3zt" "C:\Users\user\Downloads\Mar_02_Contract_19.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 7036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 6012 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firebasestorage.googleapis.com/v0/b/dulcet-bonito-377702.appspot.com/o/NjbqZi57b9%2FMar_02_Contract_19.zip?alt=media&token=26aff41a-e640-4741-9b66-c3821f31a7d0 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

Malware Configuration

Threatname: Qbot Downloader

{"Download Url": "https://firebasestorage.googleapis.com/v0/b/dulcet-bonito-377702.appspot.com/o/NjbqZi57b9%2FMar_02_Contract_19.zip?alt=media&token=26aff41a-e640-4741-9b66-c3821f31a7d0"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Mar_02_Contract_12.pdf	JoeSecurity_QbotDownloader	Yara detected Qbot Downloader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: Mar_02_Contract_12.pdf

Malware Configuration Extractor: Qbot Downloader {"Download Url": "https://firebasestorage.googleapis.com/v0/b/dulcet-bonito-377702.appspot.com/o/NjbqZi57b9%2FMar_02_Contract_19.zip?alt=media&token=26aff41a-e640-4741-9b66-c3821f31a7d0"}

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Spreading

Yara detected Qbot Downloader

Source: Yara match

File source: Mar_02_Contract_12.pdf, type: SAMPLE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://firebasestorage.googleapis.com/v0/b/dulcet-bonito-377702.appspot.com/o/NjbqZi57b9%2FMar_02_Contract_19.zip?alt=media&token=26aff41a-e640-4741-9b66-c3821f31a7d0

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: Mar_02_Contract_12.pdf

String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/dulcet-bonito-377702.appspot.com/o/NjbqZi57b9%2FMar_02_C

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic

HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: Mar_02_Contract_12.pdf	Initial sample: https://firebasestorage.googleapis.com/v0/b/dulcet-bonito-377702.appspot.com/o/NjbqZi57b9%2FMar_02_Contract_19.zip?alt=media&token=26aff41a-e640-4741-9b66-c3821f31a7d0
Source: Mar_02_Contract_12.pdf	Initial sample: https://firebasestorage.googleapis.com/v0/b/dulcet-bonito-377702.appspot.com/o/njbqzi57b9%2fmar_02_contract_19.zip?alt=media&token=26aff41a-e640-4741-9b66-c3821f31a7d0

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Mar_02_Contract_12.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 --field-trial-handle=1880,i,15371601189275763345,10103813945144653960,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firebasestorage.googleapis.com/v0/b/dulcet-bonito-377702.appspot.com/o/NjbqZi57b9%2FMar_02_Contract_19.zip?alt=media&token=26aff41a-e640-4741-9b66-c3821f31a7d0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Mar_02_Contract_19.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\m1vyocb5.3zt" "C:\Users\user\Downloads\Mar_02_Contract_19.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 --field-trial-handle=1880,i,15371601189275763345,10103813945144653960,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Mar_02_Contract_19.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\m1vyocb5.3zt" "C:\Users\user\Downloads\Mar_02_Contract_19.zip	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7036:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2108:120:WilError_01

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx

Jump to behavior

Source: classification engine

Classification label: mal52.spre.troj.winPDF@45/58@4/6

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: Mar_02_Contract_12.pdf	Initial sample: PDF keyword /JS count = 0
Source: Mar_02_Contract_12.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Mar_02_Contract_12.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7136	Thread sleep count: 296 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7136	Thread sleep time: -148000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 9_2_0103B1D6 GetSystemInfo,

9_2_0103B1D6

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\m1vyocb5.3zt" "C:\Users\user\Downloads\Mar_02_Contract_19.zip

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Spearphishing Link	Windows Management Instrumentation	Path Interception	11 Process Injection	3 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	3 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	14 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Mar_02_Contract_12.pdf	3%	ReversingLabs

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.203.109	true	false	high
www.google.com	142.250.203.100	true	false	high
clients.l.google.com	142.250.203.110	true	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.203.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	818958
Start date and time:	2023-03-02 21:01:26 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Mar_02_Contract_12.pdf
Detection:	MAL
Classification:	mal52.spre.troj.winPDF@45/58@4/6
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 47 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.21.22.179, 2.21.22.155, 23.54.113.182, 142.250.203.106, 172.217.168.10, 172.217.168.42, 142.250.203.99, 34.104.35.123
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, acroipm2.adobe.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, edgedl.me.gvt1.com, a122.dscd.akamai.net, update.googleapis.com, firebasestorage.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
VT rate limit hit for: Mar_02_Contract_12.pdf

Simulations

Behavior and APIs

Time	Type	Description
21:02:31	API Interceptor	1x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	ACH_notification.html	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse
	https://www.bing.com/ck/a?!&&p=56d98d31a49580d8JmltdHM9MTY3NzcxNTIwMCZpZ3VpZD0wNWIyMTFlZS0wNmY3LTY2YzItM2UxZS0wMzc5MDcyMzY3ODMmaW5zaWQ9NTEyMA&ptn=3&hsh=3&fclid=05b211ee-06f7-66c2-3e1e-037907236783&u=a1aHR0cHM6Ly9lYXp3b3Jrcy5jb20vaW5kZXgucGhw#herbertn@airborn.com	Get hash	malicious	Unknown	Browse
	http://www.tobramedical.com	Get hash	malicious	Unknown	Browse
	https://kinematics.starmidwest.com	Get hash	malicious	Unknown	Browse
	https://faas-nyc1-2ef2e6cc.doserverless.co/api/v1/web/fn-a0d6b988-2d39-4261-b1f3-196290d2513e/default/bra-des-cliente	Get hash	malicious	Unknown	Browse
	https://www.bing.com/ck/a?!&&p=56d98d31a49580d8JmltdHM9MTY3NzcxNTIwMCZpZ3VpZD0wNWIyMTFlZS0wNmY3LTY2YzItM2UxZS0wMzc5MDcyMzY3ODMmaW5zaWQ9NTEyMA&ptn=3&hsh=3&fclid=05b211ee-06f7-66c2-3e1e-037907236783&u=a1aHR0cHM6Ly9lYXp3b3Jrcy5jb20vaW5kZXgucGhw#cvankampen@noch.org	Get hash	malicious	Unknown	Browse
	https://offers.expobeds.ie/offer/W210797V3E?notrack=b4088f046bf9a570f2964ffc86d258ff	Get hash	malicious	Unknown	Browse
	https://www.hitbullseye.com/disqus/delete_disqus.php?redirectto=https%3a%2f%2fiamjewelz17.com/?x=khoang@inspirebrands.com	Get hash	malicious	HTMLPhisher	Browse
	https://www.canva.com/design/DAFcDeS-VZU/K1ywoAuj460b056YvNHnRw/view?utm_content=DAFcDeS-VZU&utm_campaign=designshare&utm_medium=link&utm_source=publishsharelink	Get hash	malicious	Unknown	Browse
	GRC-344540.html	Get hash	malicious	Unknown	Browse
	http://tsj.gob.ve/c/blogs/find_entry?p_1_id=0&noSuchEntryRedirect=https://dama.org//pinacoteca.xn--nario-rta.gov.co/mv/home/docs411/	Get hash	malicious	Unknown	Browse
	https://mailres.remodels.best/conceptions.html?grant=seattlesales@micontrols.com	Get hash	malicious	Unknown	Browse
	https://sites.google.com/view/wright-casey-p-a/home	Get hash	malicious	Unknown	Browse
	https://sites.google.com/view/priority1home/home	Get hash	malicious	HTMLPhisher	Browse
	https://envireaupuits-my.sharepoint.com/:u:/p/rmccormack/EfcDZus65mRGqNH2WaZeymwBRH5JqWp2U1SPVJrUZWyXnA	Get hash	malicious	Unknown	Browse
	https://envireaupuits-my.sharepoint.com/:u:/p/rmccormack/EfcDZus65mRGqNH2WaZeymwBRH5JqWp2U1SPVJrUZWyXnA	Get hash	malicious	Unknown	Browse
	ATT69800.htm	Get hash	malicious	HTMLPhisher	Browse
	Play_Now #U23ee#Ufe0f #U25b6#Ufe0f #U23ed#Ufe0f 3mins25secs.html	Get hash	malicious	HTMLPhisher	Browse
	#Ud83d#Udcd1Monthly Payable.html	Get hash	malicious	HTMLPhisher	Browse
	V_N# Wed, March 1, 2023 #82954.html	Get hash	malicious	HTMLPhisher	Browse

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.573080752456157
Encrypted:	false
SSDEEP:	3:m+lvns8RzYOCGLvHkWBGKuKjXKLNjKLuVqk/YUa8kGoMkt6HNl/iTFJrqzOJkvPo:men9YOFLvEWdM9QY/5doltWvi7Z+P41
MD5:	36F7EB61EFEEAD9FDA0080590DAD8905
SHA1:	B285F7FAC7C792DDF1EF7A935F6B4C7604E963FA
SHA-256:	0CA902C1BC956BA26B6E7333C080872ED7A458DE769C5D0EB6F82D61A0E87F2C
SHA-512:	BF0B8536070602867C4E541A89E24EE6E0633FF34D43A1FDC614FBDB30B38963BB753A26A9B2BC3D5F519277FA38A252DF0E4F9F8CCFAC2278B3E4CFD40CDB9B
Malicious:	false
Preview:	0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js ....#.T/....."#.Db..._..A.A..Eo........z.............d.{v.^.G...d.W.:...P..k%..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.523039701692116
Encrypted:	false
SSDEEP:	3:m+lF9NX6v8RzYOCGLvHktWVOc0GlKtVt67TkGoMktzlllle98fZe/O+/rkwGhkgB:mi9NqEYOFLvEkeGQtHedoltry8Be7YwE
MD5:	FC527DDFCAD222CF15EFCBE2EDA7A589
SHA1:	EB801A50359A88886B53A53DD5608FA4AE79EF2B
SHA-256:	560D1A9B140D09BEA3BF209CABFE92ECC93068C424F0BA355C13B7E9061806CF
SHA-512:	04207A57FB6E36ED5B0D03C9BCB822997F4D82FED6FB2A0CD7AF2C029720E90A5D43190D68753AFAE351966332CBED367E3C24D4223053990DF1576F5FC9FF0F
Malicious:	false
Preview:	0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js ....#.T/....."#.D..._..A.A..Eo...................1.x.'.vI..*\|Z..o...+.4....0..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.569053937304021
Encrypted:	false
SSDEEP:	6:mMyEYOFLvEWdVFLBKFjVFLBKFlQhuZE7llUoltxFgt/RlUoSjGY1:DyeRVFAFjVFAFC7llxl9gtZlUo6
MD5:	5CD904D4CCDC0C3291BB91DCFA903296
SHA1:	488953225B29C7BE2E944198B322AE1EBA21B247
SHA-256:	CD9A9D4347AF91E7019D5F29FDEAE36765B25D8F5D884C3EF5B5BE5E0B46B454
SHA-512:	9ECC2A939CEB7B7FB005DF31BB86DFF4D606DE5B10D6D8F88DAE716F4DBFC6F522114955A25B16F29045DB5FA945F80BF0E60E747A63784DD10D7C5245E9983B
Malicious:	false
Preview:	0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js .^..#.T/....."#.D..._..A.A..Eo.........p..........hvDO.N.t@.....n.*...... ....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.6606339913617605
Encrypted:	false
SSDEEP:	6:mNtVYOFLvEWdFCi5RskGCLltU9uiWulHyA1:IbRkiDCCLlWjWus
MD5:	564C494910C82D27B2270B38EFAE8454
SHA1:	43ACFFF315F64AD7504979BD6D1C616EFFB244F3
SHA-256:	87268F955220AD17BDCD964919DEE2D206A2D0BC514970EF948FA1CDA6629B9F
SHA-512:	C48115F6808E8A6F33F83CE4AA3AF4133C98F1F09A2FE371C15D9ECF4DD0233E6FE32E78A045277F4106AF4E684D075335FC8276E29A282CC48EDAFB51124724
Malicious:	false
Preview:	0\r..m......h.....'....._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-tool-view.js ..!.#.T/....."#.D...._..A.A..Eo...................8 P..a...R..Y....7.@..2Dm{..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.540118905437101
Encrypted:	false
SSDEEP:	6:m+yiXYOFLvEWd7VIGXVu3UB3dolt9iVyh9PT41:pyixRuF+3qlqV41T
MD5:	5D38425CD8CE4A9D408FACCE916AA5B2
SHA1:	071D76CFA48065631FE6CB681C7388B0E72DB550
SHA-256:	47FA49753B526AFEF6D3A54CFC91F3F08B300A58C4BB2FD3E688892DF35F7029
SHA-512:	60A2C921E80B3ED04FC85747DA67E10B7DC5ABD6DDD9901AA1A35415829998918843C47A9180B917E6B5BD6E87B4902B3BE2C0FA15739810A338485B49CEFB82
Malicious:	false
Preview:	0\r..m......R...kP]g...._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/selector.js ....#.T/....."#.D.Z.._..A.A..Eo........).........k.Q.....-_..y.....O...>..1....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.5913097701416685
Encrypted:	false
SSDEEP:	6:mvYOFLvEWdhwjQ5yDxkoltE73ZIl6P41:0RhkeyDLl2DZ
MD5:	ECD5C4559A388F002C40D4A1D4159E90
SHA1:	10E94D8C4A82DE2FC75D4ECBEA434DADDA6AD79B
SHA-256:	7843C14E723BFB7E810C8D8806C3DF6EF1CF57FE363FD444BE348EE185D40338
SHA-512:	FDCAF211C694B197F4335248948F8E9686126D528461B58C3167BB3D5DBE031F8CCFD9B4385C6B47D8DCC3CA19A7ED3BEB35CC847B8BDD89D11ED276F40F71FC
Malicious:	false
Preview:	0\r..m......X.....V....._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/plugin.js ..p.#.T/....."#.D...._..A.A..Eo...................].>....uUf..N...k......c..l.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.523638161144265
Encrypted:	false
SSDEEP:	3:m+lZd8RzYOCGLvHkWBGKuKjXKX7KoQRA/KVdKLuVFxuZTQ1GoMktD7//lVcyxMtg:mJYOFLvEWdGQRQOdQttKGoltDrrD6g1
MD5:	D255CD3D9573A7B985154665D3F87240
SHA1:	0E649B0E3730445D3053BF677AAE4B5991637D8C
SHA-256:	61212A623BBF013884D8FFA425FC0BAA9C48BCD247C17975CE4A1EA89A63A077
SHA-512:	5B23D66521BA551CDC50C57A89842C98CA60CD23C6AC5258AE72E6330655AD9CFBF4BE1E38FFC441AD64DA1BF93798E672C7AFB19BD5F14CD66CE12343D4EEBE
Malicious:	false
Preview:	0\r..m......Q..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/plugin.js ....#.T/....."#.D.v.._..A.A..Eo.........7..........c..y/L....\|y.n..C/I.....X7-ne.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.501033580864682
Encrypted:	false
SSDEEP:	3:m+lLp08RzYOCGLvHkfaMMuVh38ESGoMktuVQMWqg4nRb7om5m1:mOYOFLvECMLh8ELoltRuR/41
MD5:	A77AB6A40326EAC41E35DEF1D42E1B78
SHA1:	43D923FD1F9425AAF01D25780F125F764E4F4630
SHA-256:	769C7784F153DA758FAAAFECCA03EF78A3B4EF2F724F548AF75CCAC4FD1E038F
SHA-512:	7B3ECB96B6A40C0C2C6DF019D15CF928044B0A9B2876727D65F86DE4948F6FAAD14E9A528163DB856AA980C105086F7A9F51F3D6E32AD1FC1B98DB2165256458
Malicious:	false
Preview:	0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js ....#.T/....."#.DK..._..A.A..Eo......"............y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.567891141715356
Encrypted:	false
SSDEEP:	6:mGpYOFLvEWdzAAu+Da2sLltn3UGm0bbsIDMGH41:XfRMoajLlqVKsIZ
MD5:	70848E2615C7EC3B483D6E50079200E6
SHA1:	A4384469073FFFAC86A8E66BC840F652E8768B00
SHA-256:	6BBB9861074AACA0BB778921EE10528097C05220CFFDD6FEA6784E38461F236C
SHA-512:	F1409AD7FEF65BA0F63FCB31C6E8A6A3EFFF22733B2CCC8EE7C38DBF17A88C01227A98EE032BD5C645DF5A9377D31554ACF5F45410A2D4A73C9C2BE1746A91C2
Malicious:	false
Preview:	0\r..m......T....,.^...._keyhttps://rna-resource.acrobat.com/static/js/plugins/walk-through/js/selector.js .N.#.T/....."#.D.Sq._..A.A..Eo......-../..........`.....^....L>..Xa./......C.y.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	214
Entropy (8bit):	5.448338803304971
Encrypted:	false
SSDEEP:	6:m4fPYOFLvEWdtuLzxaleWI7holt6by0zBUKSAA1:pReYePalIb
MD5:	D33CC8D4D0CB7F7ACC057CB2F2F15CDF
SHA1:	5C3B60CE423ABCB98D43BEA4CB357FE0C461D291
SHA-256:	FE82EC841BBBC17678A005FD589B6249EF64A2B7F272FC9BC93ED6B679D607AA
SHA-512:	CD17050E5AB1E9781EA663E6ABC720187163A5B9FA6845D2111017E8A255C237A34D4678329A6EC0BE23300AB02362CB8AE1EFE3210CD2C06E580E530ADF2360
Malicious:	false
Preview:	0\r..m......V..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/search-summary/js/selector.js ....#.T/....."#.D.3.._..A.A..Eo......0g/.........Q..E.=....=h`t..t..3%A.F$..w..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	177
Entropy (8bit):	5.487432667455583
Encrypted:	false
SSDEEP:	3:m+l64HXlA8RzYOCGLvHkjXMLOWFv60Gw/nioMktky8d1dn76KohyP5m1:md4HXXYOFLvEjMSWFv60lioltk3jUdyA
MD5:	A8DF7D2B0BAECDB6F4D88186E4BA2F93
SHA1:	27D691882E6A17DC32FA12F5C4F62A9155BF4B7C
SHA-256:	2A5889ECFF065DE71E5AAFFDA03850976268C6748250718DB11949DBC03857A8
SHA-512:	AEE4E1BAFA0F01D01FE9BEEF35CB45FEDB3DC9AEDBD80C5CAEC5D1C1FACFA7A2B5D9C65DDDF892C461E3D077724BCC79F673686444B52611ABEA4D53983C394E
Malicious:	false
Preview:	0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js .~..#.T/....."#.Df..._..A.A..Eo......^............PU ....t^.....a.k..u.7.M.BW6#}..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.48971557931897
Encrypted:	false
SSDEEP:	3:m+lpSUlIv8RzYOCGLvHkWBGKuK2fKVLyBll5BeTdoMktsl/jUPqf9tsDMaPV44m1:mkl9YOFLvEWsfOLyBllf0doltEQPqVyq
MD5:	2A2387FFEAC96A497C9AAF460FB0AE62
SHA1:	6A933B00AAFF90104991E8A4551E4FCC3B5763EC
SHA-256:	B6B242FD90C4D17C4B6E65746E6AE7FA69247CA385B4FBBDF872D5BE49103F9B
SHA-512:	FA643E1D834C70B39C96403961B5DA458ADE38D780C56FF8B2EAE4CC47362FC0B2C8972ED53D34DBC3ACCA9E2DC08E4ADBE51C40485BCC49C5DFA9EAC3FF4AEA
Malicious:	false
Preview:	0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js ....#.T/....."#.D.de._..A.A..Eo........f...........q.O...j....._y..L^z...?..@N..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.5845134567307975
Encrypted:	false
SSDEEP:	6:mt9YOFLvEWdVFLBKFjVFLBKFlyVboltvtwSeKaT9pr1:URVFAFjVFAFKMl5twSeKaTL
MD5:	22C5BFBD850D50160BCCCF689F2FAB32
SHA1:	A9479D703A72689B87E64020A8C1A1E6BFFA38A9
SHA-256:	AC977346924BBE29A30D252368936BA9B468333E02D72E6835EBA684EFCA1DCF
SHA-512:	5D5B144AF659F869F1D349BB06B4B2DA6DC734198C68772B81A687FC08668F49B4784A9ED1D21E329043C5F7DB88F0BEF5F802AA54F7605B82D66609033C0745
Malicious:	false
Preview:	0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js ...#.T/....."#.D..._..A.A..Eo......_.................H...{...2../.k`..r4.C. .A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.532894845301939
Encrypted:	false
SSDEEP:	6:mq9YOFLvEWdzAHdQjwlz46mqltXt5GFCaa+41:NRMHdfjmqlpt5Gda+
MD5:	D7C8D55300D72221B2F3D27FC2917763
SHA1:	2F338B76CCA45F66D3FE0C280E1DEE00A84D2184
SHA-256:	7389841936C05F4AAA1A21FDC3C6F9CC3E24EFD73FC9FE97A6CB570E68830EB4
SHA-512:	6751296903D74D899E690783C0E15AB7895DF550C51CB7CA76DBF2150174E19FCB4A48AB3B711F9E784A76BD1D9A337EC8B752EFA0F01BB0CFF59F6D743CD0D9
Malicious:	false
Preview:	0\r..m......R....L......_keyhttps://rna-resource.acrobat.com/static/js/plugins/walk-through/js/plugin.js .d..#.T/....."#.Dq.q._..A.A..Eo.....................G.3D.....Q.g0...._.Q.........A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.486279100747758
Encrypted:	false
SSDEEP:	6:ms2VYOFLvEWdvBIEGdeXugLgaljkolt6g11:BsR2EsepLgaljhl
MD5:	174DDF2430D607F371830658F88444D6
SHA1:	801B2E97FF2B0825945D171DF90ED232D558B916
SHA-256:	FB16D2B4072CA6D78DE4261E635796F130556B76148143F9A7D6962075ACF35B
SHA-512:	C8E941AC79AFF79A745CC17C11D7F5D4B1CDCA10ED5AA4FF4A7F1AE443C6AD56499476ADDF81E51B5B104C7F282906541EC2140D4ED5E31C2B65C4E266033D42
Malicious:	false
Preview:	0\r..m......S...]......._keyhttps://rna-resource.acrobat.com/static/js/plugins/add-account/js/selector.js ..x.#.T/....."#.D`v.._..A.A..Eo........._.........A.o]@r..Q.....<w.....].n\....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	5.610547385544422
Encrypted:	false
SSDEEP:	6:maVYOFLvEWdwAPCQVGQtSkoltVe7xm7OhKlvA1:RbR16MGwShlG7xmJ
MD5:	E2A302C60E27F149033589F7065A7EE0
SHA1:	09E96020EDC742914A623B5D83866DA2B5DFF356
SHA-256:	BF1C2FADEF5B8DA9F34C221D5EE6465797B835CAA06241796E56D0117C250556
SHA-512:	C9B6DB0CACA03868220D605356AF62E484F1E53D87BE3A356FA0CFC0AECF9F46D8817BDF818382F28A9F69029AA2F024ABB197B62B96CC4AD10D591586CC0DA2
Malicious:	false
Preview:	0\r..m......J......{...._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/plugin.js ...#.T/....."#.D.v.._..A.A..Eo.........'..........4T].....Tw.....(..b...EO....9.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.550197050596209
Encrypted:	false
SSDEEP:	6:ms2gEYOFLvEWdGQRQVukKlllo30koltTlndFt1:B2geRHRQj+llokhl
MD5:	BDB027449621B6C2E45C79291C35266D
SHA1:	61492FCC62FEA1964677D31A999B456EF03D6892
SHA-256:	83C4EA5F37E7209BED7F049BC830D5228F05AE7ECE852A6CEFF754EDC16B5324
SHA-512:	0224E803FDCA59CF3EFC7DEA7DCFAEDBBCDCF822DD29A99F08A533E3DC40D4EB1A04F1396B4967704664C1D161AAB85758DBFC14F11EE6D7C445823204507897
Malicious:	false
Preview:	0\r..m......S...W.%z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/selector.js .;S.#.T/....."#.D4L.._..A.A..Eo......Q..........@..{o]...9o\|..qY....T....{..u.b..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.579648114147671
Encrypted:	false
SSDEEP:	6:mzyEYOFLvEWdrIOQVjQlV6m0kolt4Et1S/1:WyeRlCjwQLlWEt1
MD5:	34D0B7061498008A1F06B5585A32B362
SHA1:	0975D8FCB58B1542F27D1330E0DBABF10DB84693
SHA-256:	3002B7B01ADED4A7F04C9BA190E01ABB3211F2FC8F52A000021143078EBEDB4E
SHA-512:	CC47C999C65B91A05AC2802DB73B7B53AD0EE3460C48883792C1366DB5E49BFAE75DE18D1802E4B7EFE1310AA4BA686B9B52939F21C40549F0982F9A453013DF
Malicious:	false
Preview:	0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js ....#.T/....."#.D4.w._..A.A..Eo.......I..........t\a......x5.'OuE.C..@......x..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.53550087331695
Encrypted:	false
SSDEEP:	6:mnYOFLvEWdhwyudwRa3kolt+H/olwrqwK+41:wRh7RaxlQwqGwK+
MD5:	85D439EFD00ED0D4ACA50741F79616F5
SHA1:	88E28BA33224C41594F49C594813738A9DD4F424
SHA-256:	7E745F74F2BC6F23F8BBD4AFE8D95D1E0E935DDCFCB4E073132D045FA9664E76
SHA-512:	E162431AA098CD51EEA9DD3788D5086023386A19F727ECA3D80B004DA4AC27CA6792CF000123D122151F2678AA8E87931F71E062A96606CF12464045E3F4B3E7
Malicious:	false
Preview:	0\r..m......Z.........._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/selector.js ....#.T/....."#.D...._..A.A..Eo........G................7...o..a=.98I......(3.$G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.530012937903179
Encrypted:	false
SSDEEP:	6:mYXYOFLvEWdrROk/RJbuX3lHF80kolt+QfO441:/RrROk/YVHFxlAQfL
MD5:	952BB68FEA81A50113B49603C771F3DD
SHA1:	83876DCE8F65209C0F6B7CFE2E71D2F11C72631C
SHA-256:	45697EEF40FCB4509365D21D8CAEADD6D8F306682028F6C467EEB6EB767F58A7
SHA-512:	844EE6B03E3FD5E2422F4FB11CD529A30720A5A7CBC6C2D1C972DEF38A48638BC638EA68289D7565A189CCF2FA33A570F86DA5535A4065CECDFE5354FA56272E
Malicious:	false
Preview:	0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ....#.T/....."#.D.Nw._..A.A..Eo...... .g..........~..rw.+[....!.)?..f.U..(=.=.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	186
Entropy (8bit):	5.505276600673752
Encrypted:	false
SSDEEP:	3:m+lhD4ll08RzYOCGLvHkWBGKuKdTSV68M/l6R/UoMktof/HzoIN1OFPL4m1:mmDEYOFLvEWXI68sl6OoltoffzV1QPLB
MD5:	7E8440CBDEAF67F09409EF61A6D43DC0
SHA1:	AA17CBB3E5629B207CAA84CB05FD3B064B0CECCE
SHA-256:	450E26F3075389CC458D8B8B524C567412DE56320078E21094EE3712D869C994
SHA-512:	8EE8870F68171B481DA88EF1BD73483BEE3166A964BC59C5EC07564DD378278658C16D1629A45C9027BBF7750EBDF5A4F42038BCA016B595FE99D00A15DA4DE7
Malicious:	false
Preview:	0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ....#.T/....."#.D.4e._..A.A..Eo....................~]...%s..<...n.f..<.....1#..U..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.568198773333403
Encrypted:	false
SSDEEP:	3:m+l+nq1A8RzYOCGLvHkWBGKuKjXKLNfKPWFvRMGw7I76ioMkta28D6EsEJeUm1:m52YOFLvEWdMAu7QqholtjEvsEJ41
MD5:	F7F116F6632D83C187219542B952AF22
SHA1:	A561A2B28E84E10E56A2D2817E1DD60BBC812D32
SHA-256:	191302E0FCFC6487B0AB5006965622F1F050284B787290A97F65A4F2878DBA2C
SHA-512:	F1523F14B93476C87AC769EC209054F4B3CED7FA28581B2E5BDE51EE849D0ADDAA1500B3B492AA2B7FE77527A93BD7041039F8692632A75F8009EE22D57F8361
Malicious:	false
Preview:	0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js ....#.T/....."#.D.3.._..A.A..Eo........._..........z._a...'.v.......4p3..1.']...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.525773000996497
Encrypted:	false
SSDEEP:	3:m+lf1UldA8RzYOCGLvHkWBGKuKjXK9QXAdWKfKPWFvwKKlEtoMktlmFoDb7T2/My:mYilPYOFLvEWd8CAdAu8lYoltlwong1
MD5:	A2BA2BFE5B578263CA48BA96B97F6DA4
SHA1:	5301E6FA7707A870C26B887A819181F3A50BAFCA
SHA-256:	ABDCC62560C05D9A9EB407FDF2B7B36B3E17C16228BAFFAFFB3836048F6C37D9
SHA-512:	810A518CB7AE5353831BFCA5BE9885049343FAED4BC787D8E82943CEC2FD1DB8DBC4C0F847BF69851DB139E0AE8D3CF087DEF319CCA59939DA8D7D5D5A3232D4
Malicious:	false
Preview:	0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js ../.#.T/....."#.Dyw.._..A.A..Eo......._.2........c}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.552009986840419
Encrypted:	false
SSDEEP:	6:mY8nYOFLvEWdrROk/Iu+slRkoltUN16wG1:F8hRrROk/BrlU
MD5:	77C2864B5AA43EBA4ADEBD1A48C32F1D
SHA1:	3556AC55856CB3D12ECEE9FDB49AF5BE43A97B25
SHA-256:	0D8985BCF2E6466701B3BA8B97708C1AF0DF7949B8D214A5F2A899E26443C4BE
SHA-512:	F8487424B0C6EC42E3FDE66A6B1D57E82662C377914B91BEC14F26AE86DF536E8283AA3B9A15833462DC19944C59B03B499929E64C0BF03BAEA1B146147D86A5
Malicious:	false
Preview:	0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js ...#.T/....."#.D..w._..A.A..Eo.......r7&..........%.k.SZ..~W.....:)'B..ad......A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.614333791770774
Encrypted:	false
SSDEEP:	6:mLrnYOFLvEWdrIoJUQixu42s3koltGloeJIi1:ehRc/E7s3hlIoeJI
MD5:	7B585FEEC03A5A6B8D9F309C24364980
SHA1:	D03AD4E4010CD2C6618A720C115B1DC286DFB6AE
SHA-256:	C5D521E705183996912D41E7A6CAA84DDBBAA27F4D8875F6181312F5B657B5A0
SHA-512:	6D79C81DB07C4D1D58F2DD0E40BD1FDA2D31EDE22E4FA2F53FD11BBBC6AD7C4A3274FDE4DA38945EC145784C71077190571A36208B0E082824A7A984DE2BAA63
Malicious:	false
Preview:	0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js ....#.T/....."#.D..x._..A.A..Eo.......U./.........;"./N_.,.:C..2....9L.H...3:...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.526102560958212
Encrypted:	false
SSDEEP:	6:mOEYOFLvEWdrIhu2slKXkolt0dBzgm2d/1:0R5KXhlC/R
MD5:	BE2C575E0BCCBEF04D1ED034BD0551C5
SHA1:	37D4290C168CCA6B57A07D27D02B43F81BE521F8
SHA-256:	6B8F87AEDC2873065A5EAE82BD509FB01DB00F6E792FA972286E9AB79E9173AD
SHA-512:	047D1C065D890BE34C44B4E5777B70595C9C69C81DD8601012DEDCEDE8E2929731FDD841A676CE058DB512F0C5563420AB0168054580F48545E00A7A83AFB8A8
Malicious:	false
Preview:	0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js .m..#.T/....."#.D..v._..A.A..Eo......x#."........Z.Z}Q..4.o....0+..[\|..n:*..U.W.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.5096750187475685
Encrypted:	false
SSDEEP:	3:m+l8UElLA8RzYOCGLvHkWBGKuKPK7CvBrsllioMkt2GBiaQ562HvpMm1:mAElVYOFLvEW1KWQlsoltmx56uvp1
MD5:	D6A5BFDCD24E2C496E01AA17D921903B
SHA1:	7F729BAE48952776FC2B8F77B6AFE0905E87159C
SHA-256:	130D4AABCBB3023393B8FCF6DDC7D738E8AFC2D98CB90C67609B76CAC043BA0F
SHA-512:	D65D88385D2C3E2410638C7C370B5A1E6EAFEF1165E9F43E31EC3EE372CA32737CC81CBF08309C6319DD34F4CAA02E209B70F0E920E605B78B16AB6D07868943
Malicious:	false
Preview:	0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js ..a.#.T/....."#.D.m8._..A.A..Eo......ib..........z?...SwC...^..y.....V..7R-O.....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.6127222679334645
Encrypted:	false
SSDEEP:	6:mWYOFLvEWdBJvvum6m0kolt2UDLYtmOZn1:xRBJ76LlpDcFZ
MD5:	A6E5BC0AE974331B6C86951CE7044F3F
SHA1:	FB8A584315FBF16E674BB699CBCA445013C4A0FF
SHA-256:	0CB4861BFED460A50FFF41B5D0DEC0FCE9C792E73D662DD5F0DC17EF83DF7577
SHA-512:	D9A91421DD215611221117B389ED56C0378013098A1D5923CC956BD4700CE4201076BA6BA8977FE3892839A04E11E92D117C927402D11B3FF8C2CB3C6BA7B5F7
Malicious:	false
Preview:	0\r..m......V.....h....._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/selector.js .h..#.T/....."#.D.<.._..A.A..Eo......D.5.............t.q..W.EZ....1...[.zC.7mD..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.575078453257644
Encrypted:	false
SSDEEP:	6:msRPYOFLvEWIa7zp7Pp6ioltyF/F8VPu1:BPHtp+l8Fm
MD5:	7472CEAE863577D68929B3E02C7C2874
SHA1:	906604D987B78B0F21E2F9D05D39745C84A474BC
SHA-256:	BE0523A7A118DC9CB754D0A867CF001C7C47EECC69A72353085EDA38095DF9BA
SHA-512:	D1174A471B2A2E8723C47913AF820810AE41D8DAF501B1DF81FB931713CDD18B8CD9A0E18B21B5E0160C3106EE557E02CE77C9341DD809DE04E3C35E12A670E2
Malicious:	false
Preview:	0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js ....#.T/....."#.DZ..._..A.A..Eo....................L...Im.@.........E.nW...IP..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.56382805910632
Encrypted:	false
SSDEEP:	6:mKPYOFLvEWdENU9Qrl/UoGoltct6wiM3Y1:bJRT9q//lor
MD5:	C9B92384552F524C05DD039805BF9FF6
SHA1:	9B888FBCA9913172144B550E9DF6F4B5326B5AD0
SHA-256:	F3B1253D5E1C6BA53915FECA74FDC5E1C2560C7F5A7D52FEB10A180D5E1E196D
SHA-512:	673F3667F7C8846968F8DC508206B094A948E4A9FAA5549D7D8519D42705FD6ED738D685E17ACFE854D14B3BC192CCEE3F98A1CE477BBE1103FB66FCD883B4D6
Malicious:	false
Preview:	0\r..m......P...Yft....._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/plugin.js ..Y.#.T/....."#.D[.._..A.A..Eo.......#.............M....m+lS..e.....<7.U.P8*.0K.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.596303479789796
Encrypted:	false
SSDEEP:	6:mQt6EYOFLvEWdccAHQjxtjxkoltlKjBRCh/41:XRc98t/l/KDi/
MD5:	90DC3F9B8BFEE7242B1CD9965B0E991D
SHA1:	E1C897EC547C6BA086C81D054DC7BAC2DB0916C2
SHA-256:	4B513484F4C030C120FC6E50B85D2299163A9064E31BD694247D3D6FCDC7F295
SHA-512:	888FCF120780059568ED8069B1FF3F2EBF4B1F120E74868B6B7363DF939C0A9C7240C584937151230BEE029BB425F125489434D90B498BE9D36717447048276B
Malicious:	false
Preview:	0\r..m......P...W3......_keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/plugin.js ....#.T/....."#.D...._..A.A..Eo......[.5.........PJm...0x.x..RD...BB!@5..<..]....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.577228158764207
Encrypted:	false
SSDEEP:	6:mqs6XYOFLvEWdFCi5mhuafw2lt8l9kULlF4r1:bs6xRkiEw2lW97LlF4
MD5:	C9147028A4737D5A4507A61E18275A83
SHA1:	3712780E0BD5FA7864DED746E5C85364EAB3AC07
SHA-256:	015C1BE4BE286F1FBAE34CFD3222881B7AC3B851F676C94EDED1CF45664B8B32
SHA-512:	A8A84C6E48A06A2255E3A30425C9024008D8A5A9C2DA23BA94F4C7172A6FDFB47278F8EC6ACA231556B5E1DE8BF37A42AA5E2FA2B865563902AB47CE1B1A5FAC
Malicious:	false
Preview:	0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js .{..#.T/....."#.D...._..A.A..Eo......i...........P...#4..l....5...5..).w.. .h.~..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.4639282836996355
Encrypted:	false
SSDEEP:	3:m+lPHYs8RzYOCGLvHkWBGKuKjXKXqjuSKPWFv1buGmkGoMktrU/llECcu1isLK5y:mhYOFLvEWd/aFuf6Gmdoltr0PEN941
MD5:	747C80FDBC677F049F20C829023C2FE8
SHA1:	F249F7CAC19AAB8922A7C87DF197090478CFEF9A
SHA-256:	3224AB130FA82D7AD4695B4684FA64E673E6C0090AB611E1FD24EA933A05794C
SHA-512:	3A2910FA7DFF64745FB873F03495C28ED774E6CFD0025D04C5A8FDF8BFADC233C8FCFE2DE17270917DE033A4CBBAFFE339676BA42B9C75A6A99F2488692450D0
Malicious:	false
Preview:	0\r..m......W....w.m...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-recent-files/js/selector.js ....#.T/....."#.Dt@.._..A.A..Eo......3I.............a.f.m.i.o.p..3U5.....^...I.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.471079275198327
Encrypted:	false
SSDEEP:	6:mR9YOFLvEWd7VIGXOdQffQlZTolt6tLBMqVd3G4K41:2DRuRgwqlkLB9Vd2
MD5:	BEE58726CDA5BB961DB7BB2E691961DF
SHA1:	5BA4869D64E1D91A2410CE3CC8523C340C057735
SHA-256:	8182FED1AFBE39BEDCF4DDA10B70CC1419D361F522143052D7A7DE46045E08F1
SHA-512:	F04E90CD64F860384486D3E718E1F8F604127ECAEA1399AD39A75A3B4430BE4BBBD1ACCA353168EED384694C25B4EFA47AFE77DE5D081B95E9FCB97D89967990
Malicious:	false
Preview:	0\r..m......P...y.p....._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/plugin.js .o..#.T/....."#.Dr.._..A.A..Eo........m...........y.$..$.v5j...T...z.]..._S....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.541323955351434
Encrypted:	false
SSDEEP:	6:mkqYOFLvEWd8CAd9QdalyoltrTuA424r1:+RQGu7lsr
MD5:	BE823A90BAC046A76E78BB3BAC2FC6EE
SHA1:	1EFE30F3B2F65A64FA6677174939C1E9BB2A319A
SHA-256:	78C66B9C559834548441DA48E62C2FA0DC6E46E01EE4901C4B4754ABE25E1E7C
SHA-512:	8B138246E06A6C4C5F70E3BBE3B8C7D6346258C7F6A862B808E9F4BE7832D9CEFEB3F248F1FEB2652E35F597896A6DF0CEC43B14D205BCDF588AA00FA9D6CCA7
Malicious:	false
Preview:	0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js ..9.#.T/....."#.D+l.._..A.A..Eo.......)..........#..@..k(v.8g..5.~_....]Pj.*..6.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.542107265998181
Encrypted:	false
SSDEEP:	6:moXXYOFLvEWdENUAuLWmrkoltLT8yC8n1:xhRTJWmdl27
MD5:	F2CBC5992B47DC6A516A43DF05D9E4B2
SHA1:	C3C2F4A1095CC4A604EB01A2A0314B32CBE99A33
SHA-256:	E4D02B327D1D628A404FDE9C51E4E3234FE050ADC724997A0D79CCF352318AF4
SHA-512:	EAC790AAEEDFA3C6C2E0C5FA2008F808D6BA2CECEB40EB5701551631C4E54FE6548A76E2CC573AB2101F9CF4EC5B549300CE2BFFE89AB2D052C88FB433272EDF
Malicious:	false
Preview:	0\r..m......R..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/selector.js ....#.T/....."#.D.p.._..A.A..Eo......;.O>........8.../...;.\\o....1..........+..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	221
Entropy (8bit):	5.587178814813387
Encrypted:	false
SSDEEP:	6:mQZYOFLvEWdrROk/VQHlVGoltu/tsLmB41:nRrROk/V+lRlQtN
MD5:	E06CF043C34DEB4085A04FBE2472A098
SHA1:	BA75D471ED0232C02C68CEE83456F0E596EC8C7F
SHA-256:	6605D340B51F474943E9B1BFD608295EB88ED0AD6A8B68338403FE38A91BEA2A
SHA-512:	78C77E61920F24EB127F79975C0FA7140E7EC98EDA2675F7D7B86EE3DB239BD11D6430C178D74D9082712CD6637EF44154B48AE5398A739256AF348D06740888
Malicious:	false
Preview:	0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js .u0.#.T/....."#.DqY\|._..A.A..Eo......6........... ./.ev......N~..6.b.....$.j;:C...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.568503357358617
Encrypted:	false
SSDEEP:	6:mZ/lXYOFLvEWdccAWu7EQP0koltXJdm9741:qxRc6Y0hl7du7
MD5:	3356EC950ED20E8B3CB48EF8E08CC35F
SHA1:	9B777D06E6977D992278605E8130B062B3A90A9C
SHA-256:	12B71C308FFE2C28C59B125781D509B53415F6D79C4CF7663F9477EC3101F864
SHA-512:	2B61051990774506B5433FCBD207E2F9E17F0312D4B0B2A6B8566F7AF18E4FB031606AC01061B5FBAF60578F47BC318DBDF1133CF8B4D55BA098803D9680DCF7
Malicious:	false
Preview:	0\r..m......R...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/selector.js .L..#.T/....."#.D.6.._..A.A..Eo.......Q.)...........U...I.>P...X...x..0U.~;m.x.k.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.552284498064027
Encrypted:	false
SSDEEP:	3:m+lUg18RzYOCGLvHkWBGKuKjXKrAUWiKPWFvNLk/9MgkoMktp02B6shoq+Nem1:mMOYOFLvEWdwAPVuM9VkoltpJB6Jn1
MD5:	578FE5DFA0400E765012EC0116CB9AFC
SHA1:	F06874B22C65A97A5B83CF2B3FCA586A3F9635AC
SHA-256:	B6DE9555908AE96A9254E3B76D87A6EDE55ACF4B9CDE385C5DBFC50AEE3CA148
SHA-512:	DF62B4EA3169A92CD19DB7E0927FA850FC8CB81F598E60FF25BA7B24BBFC3C8CF51AB090F7C0A20F5D4406516DE661B1FB2C6F502D65A28BC5742299939DDD17
Malicious:	false
Preview:	0\r..m......L....Ey....._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/selector.js .C..#.T/....."#.D3R.._..A.A..Eo.......................k....F..D..O.n;[.1m.....=..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.602170972026944
Encrypted:	false
SSDEEP:	6:m3PXYOFLvEWdBJvYQBKt01GoltOahcsBXIh1:mxRBJQ5tIlpB
MD5:	402B4F02FDD46E1C9FF928CB57E52E36
SHA1:	3FCE5B4C628E56964602063A52064332DAB35773
SHA-256:	561477DAC9A404EFBA5EAD5B09FCC052C5A4627EDA635393561A95AFA15CBBE9
SHA-512:	DEDE5B4CAF4F70E105C8A8006BAE09DFFD9BD5BAE2669AFB22532797FA24B08F5C78DE6D24BE41401BFC57BE2C099626E5B81A6374E394B16C563110FD4F2D4C
Malicious:	false
Preview:	0\r..m......T......z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/plugin.js ....#.T/....."#.Dd.._..A.A..Eo......!{.4...........k..`..N3.... ..d..$[.....{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.559938760263989
Encrypted:	false
SSDEEP:	6:msPYOFLvEWdrROk/RJUQr/+oGoltmc3Me/1:3RrROk/sMplI
MD5:	3592FEC78E95D78C19A575423744AAD6
SHA1:	053757EA1281B36E4EA20501AAC9C48A4363F0BB
SHA-256:	440D581A091E3932F25CB5CEAE2B8AAAE6EF8BC9573865C3B15FC7A6FB59D951
SHA-512:	7B27C3BADA5E5165C5C1F519C9D94BF754709334A1FE3D70B4889830D7B219DF8CAA21213A518EB4D3968163E81C15B6CAD6BBDBB3C3DE91D795A434CDB032A6
Malicious:	false
Preview:	0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js ..J.#.T/....."#.DG.\|._..A.A..Eo......F6/..............9Q].8O.z....=..:.N.{....N{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.159438275502552
Encrypted:	false
SSDEEP:	12:sN4J+/l/Cf5tJL0gFTgraSA4MzGZSoUx7i+/l/MlwGORNRuGBMlY8oaOAdJ/mJnK:sN8xYCgM4MelyFBK/7W1I/
MD5:	27AA57F2C7FEC5993EB6CF185A056648
SHA1:	AEA971D6D859C91D2067D6778C4FB136165F3BA9
SHA-256:	D9A7564D59EA842B2825FB32558022593C9BF7811E2127AD3A5A66709C19342C
SHA-512:	EDD31DF240FBC4D66D905BB1E964253F2A59EBB5C5FA933E63E1F1F27D23C05AEDC4C27404E4369699CDD27D96CF9F7854B27244A97234260DC873288C513277
Malicious:	false
Preview:	0......oy retne....+........V..............@P.#.T/...........;.y~A.@P.#.T/..............oB...#.T/............#...(...A_./.............D.4....#.T/..........[.i..%....#.T/.............k7A.@P.#.T/..........]...I...#.T/.........,+..._.#...#.T/.........<...W..J...#.T/..........J..j......#.T/...........6<\|......#.T/...........2q....@P.#.T/...........P....V@P.#.T/.........!...0.o...#.T/............P[. q...#.T/...........3......#.T/..........v...q.....#.T/...........a.......#.T/..........C..M.....A_./.........qi.K.L.9@G.#.T/.........K..JM.gb@G.#.T/..................#.T/.........F..=z;.@P.#.T/.............o.@P.#.T/.........Gy.'.h.@P.#.T/.........:..N.A..@P.#.T/..........;/....#.T/...................#.T/.........A?.2:.....#.T/..............q....#.T/..........u\]..q...#.T/..........o..k.....#.T/..................#.T/.........^.~..z....#.T/..........+.{..'...#.T/..........@..x...#.T/............MV3.....#.T/.........)....J:...#.T/..........&.S......#.T/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.159438275502552
Encrypted:	false
SSDEEP:	12:sN4J+/l/Cf5tJL0gFTgraSA4MzGZSoUx7i+/l/MlwGORNRuGBMlY8oaOAdJ/mJnK:sN8xYCgM4MelyFBK/7W1I/
MD5:	27AA57F2C7FEC5993EB6CF185A056648
SHA1:	AEA971D6D859C91D2067D6778C4FB136165F3BA9
SHA-256:	D9A7564D59EA842B2825FB32558022593C9BF7811E2127AD3A5A66709C19342C
SHA-512:	EDD31DF240FBC4D66D905BB1E964253F2A59EBB5C5FA933E63E1F1F27D23C05AEDC4C27404E4369699CDD27D96CF9F7854B27244A97234260DC873288C513277
Malicious:	false
Preview:	0......oy retne....+........V..............@P.#.T/...........;.y~A.@P.#.T/..............oB...#.T/............#...(...A_./.............D.4....#.T/..........[.i..%....#.T/.............k7A.@P.#.T/..........]...I...#.T/.........,+..._.#...#.T/.........<...W..J...#.T/..........J..j......#.T/...........6<\|......#.T/...........2q....@P.#.T/...........P....V@P.#.T/.........!...0.o...#.T/............P[. q...#.T/...........3......#.T/..........v...q.....#.T/...........a.......#.T/..........C..M.....A_./.........qi.K.L.9@G.#.T/.........K..JM.gb@G.#.T/..................#.T/.........F..=z;.@P.#.T/.............o.@P.#.T/.........Gy.'.h.@P.#.T/.........:..N.A..@P.#.T/..........;/....#.T/...................#.T/.........A?.2:.....#.T/..............q....#.T/..........u\]..q...#.T/..........o..k.....#.T/..................#.T/.........^.~..z....#.T/..........+.{..'...#.T/..........@..x...#.T/............MV3.....#.T/.........)....J:...#.T/..........&.S......#.T/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF44d42d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.159438275502552
Encrypted:	false
SSDEEP:	12:sN4J+/l/Cf5tJL0gFTgraSA4MzGZSoUx7i+/l/MlwGORNRuGBMlY8oaOAdJ/mJnK:sN8xYCgM4MelyFBK/7W1I/
MD5:	27AA57F2C7FEC5993EB6CF185A056648
SHA1:	AEA971D6D859C91D2067D6778C4FB136165F3BA9
SHA-256:	D9A7564D59EA842B2825FB32558022593C9BF7811E2127AD3A5A66709C19342C
SHA-512:	EDD31DF240FBC4D66D905BB1E964253F2A59EBB5C5FA933E63E1F1F27D23C05AEDC4C27404E4369699CDD27D96CF9F7854B27244A97234260DC873288C513277
Malicious:	false
Preview:	0......oy retne....+........V..............@P.#.T/...........;.y~A.@P.#.T/..............oB...#.T/............#...(...A_./.............D.4....#.T/..........[.i..%....#.T/.............k7A.@P.#.T/..........]...I...#.T/.........,+..._.#...#.T/.........<...W..J...#.T/..........J..j......#.T/...........6<\|......#.T/...........2q....@P.#.T/...........P....V@P.#.T/.........!...0.o...#.T/............P[. q...#.T/...........3......#.T/..........v...q.....#.T/...........a.......#.T/..........C..M.....A_./.........qi.K.L.9@G.#.T/.........K..JM.gb@G.#.T/..................#.T/.........F..=z;.@P.#.T/.............o.@P.#.T/.........Gy.'.h.@P.#.T/.........:..N.A..@P.#.T/..........;/....#.T/...................#.T/.........A?.2:.....#.T/..............q....#.T/..........u\]..q...#.T/..........o..k.....#.T/..................#.T/.........^.~..z....#.T/..........+.{..'...#.T/..........@..x...#.T/............MV3.....#.T/.........)....J:...#.T/..........&.S......#.T/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.174989983070056
Encrypted:	false
SSDEEP:	6:kUQlyq2PWXp+N2nKuAl9OmbnIFUtdm11Zmwv331RkwOWXp+N2nKuAl9OmbjLJ:kDIvaHAahFUte1/vD5fHAaSJ
MD5:	B0EC93A65F717740570D09EB220DE218
SHA1:	AAAC02CD8B08DB870E9AE5553CB996D8FACFA358
SHA-256:	CE3C9FABD9B3542680346E9046753A637FECB026E58EAC5923BE47445EED4EDD
SHA-512:	DE13F05E662726E1B51C059298D25961F46A6EFC04FE70CE7945A80A643AB6696739642004DDE9BC08D87BADBBA48A26A919920AD9D5264521F3F67AF20F6715
Malicious:	false
Preview:	2023/03/02-21:02:37.232 e94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/03/02-21:02:37.245 e94 Recovering log #3.2023/03/02-21:02:37.246 e94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.174989983070056
Encrypted:	false
SSDEEP:	6:kUQlyq2PWXp+N2nKuAl9OmbnIFUtdm11Zmwv331RkwOWXp+N2nKuAl9OmbjLJ:kDIvaHAahFUte1/vD5fHAaSJ
MD5:	B0EC93A65F717740570D09EB220DE218
SHA1:	AAAC02CD8B08DB870E9AE5553CB996D8FACFA358
SHA-256:	CE3C9FABD9B3542680346E9046753A637FECB026E58EAC5923BE47445EED4EDD
SHA-512:	DE13F05E662726E1B51C059298D25961F46A6EFC04FE70CE7945A80A643AB6696739642004DDE9BC08D87BADBBA48A26A919920AD9D5264521F3F67AF20F6715
Malicious:	false
Preview:	2023/03/02-21:02:37.232 e94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/03/02-21:02:37.245 e94 Recovering log #3.2023/03/02-21:02:37.246 e94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF444ff9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.174989983070056
Encrypted:	false
SSDEEP:	6:kUQlyq2PWXp+N2nKuAl9OmbnIFUtdm11Zmwv331RkwOWXp+N2nKuAl9OmbjLJ:kDIvaHAahFUte1/vD5fHAaSJ
MD5:	B0EC93A65F717740570D09EB220DE218
SHA1:	AAAC02CD8B08DB870E9AE5553CB996D8FACFA358
SHA-256:	CE3C9FABD9B3542680346E9046753A637FECB026E58EAC5923BE47445EED4EDD
SHA-512:	DE13F05E662726E1B51C059298D25961F46A6EFC04FE70CE7945A80A643AB6696739642004DDE9BC08D87BADBBA48A26A919920AD9D5264521F3F67AF20F6715
Malicious:	false
Preview:	2023/03/02-21:02:37.232 e94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/03/02-21:02:37.245 e94 Recovering log #3.2023/03/02-21:02:37.246 e94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.010978819626460943
Encrypted:	false
SSDEEP:	3:ImtVdXb+j4x9pPlXlpyPll//zVrzlltD0lGQZ7XEZhGIelHdP4/X:IiVtg4x9pdM//hFwl570ZhdelG/
MD5:	E36F8F81D3C03F6AAF7D768706B7673F
SHA1:	EECE93F9E417717892E50F6A159516DD76C255B0
SHA-256:	C6E687FF9677244574F37AD2877726DF64E5BAADDA2ABE8C4759BDE8344E44F2
SHA-512:	0582ADCFA1A09095D4482C9A61475C8B77FF444BF2655DE4F6583BBB2699A054BBB2292DE2741FEEB27AFE0835B0B48F476418EE1A666DE20CA146D1EB4390A4
Malicious:	false
Preview:	VLnk.....?.......Tq.>..j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-230303050233Z-203.bmp

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 164 x -115 x 32, cbSize 75494, bits offset 54
Category:	dropped
Size (bytes):	75494
Entropy (8bit):	1.8058512220708958
Encrypted:	false
SSDEEP:	384:zqXh5Mzi0M8NrzUHlTmHLXKH6sXAmvf8Buzs+On3I9Um:wh5Mzi0xN8lyHLaHlXAm38Buzs+OYL
MD5:	475822AF42D9B769990F9BE81950717D
SHA1:	BC80841D409D3F405526D3B9D26CD1C33A397838
SHA-256:	F4CCCC892D42422D1C7B82B24ABA83363663DC6278BF0F4CCCAD78F23399D686
SHA-512:	3467D46DF16352957F9776D995206F4BA4D2317E717FAD3D81F959393F111ECDA59F5AFA9808A5C581205192DF7700B5AF69E29364703AF2D3D7A00EAB5EE14D
Malicious:	false
Preview:	BM.&......6...(............. ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000, file counter 12, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.5650839190092847
Encrypted:	false
SSDEEP:	384:3eI9dThItELJ8fwRRwZsLRGlKhsvXh+vSc:gkYZsLQhUSc
MD5:	48AEBC27754436D697B482E752322EAE
SHA1:	7FCC61F963AFC46DEEA6C396444C8B6D46790859
SHA-256:	A714F6A9A8FA37F5A3D532633AAAA077ACAE376D4005476345D90E9BAE052EDE
SHA-512:	1E78E338FCADE11BD8D2CCFA359EC2B8711AC7B0947338F77EE4A01F504D07CB9970B87C386E4FFC8F87EBE5ED5F12247AB5A2BD2F6023B6FFCAAF5FDE920138
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.287621741359086
Encrypted:	false
SSDEEP:	48:7Mcom1Cwiomiiom2om1Nom1Aiom1RROiom1oom1pom1UsZiomVsiomg/qQlmFTIV:7owVOhRCs/N49IVXEBodRBkI
MD5:	76CE408D6C06489FE0BA6220A779332C
SHA1:	7A4C5D5E98FF75A19230457836231F36E7C94BEB
SHA-256:	6CFF63A999153068B1E36DE719FC46E2F0D316FAAEBB81B5FE707FE2DF04C7FF
SHA-512:	8DFDA84218B266EB3FDABD356F990D8E44B648904CC4E91F422A83DCA27C2643836FCE768B76021C53E9052B477BEFC8E78D9046C50EB0EED742FE0F49AF355C
Malicious:	false
Preview:	.... .c........j..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s........L.s.y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.1108

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	157443
Entropy (8bit):	5.172039478677
Encrypted:	false
SSDEEP:	1536:amNTjRlaRlQShhp2VpMKRhWa11quVJzlzofqG9Z0ADWp1ttawvayKLWbVG3+2:RNj3aRlQShhp2VpMKRhWa11quVJX2
MD5:	A2C6972A1A9506ACE991068D7AD37098
SHA1:	BF4D2684587CF034BCFC6F74CED551F9E5316440
SHA-256:	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65
SHA-512:	4D03884CA5D1652A79E6D55D8F92F4D138C47D462E05C3E6A685DA6742E98841D9C63720727203B913A179892C413BFB33C05416E1675E0CF80DA98BE90BA5E4
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Marlett.FamilyName:Marlett.StyleName:Regular.MenuName:Marlett.StyleBits:0.WeightClass:500.WidthClass:5.AngleClass:0.FullName:Marlett.WritingScript:Roman.WinName:Marlett.FileLength:27724.NameArray:0,Win,1,Marlett.NameArray:0,Mac,4,Marlett.NameArray:0,Win,1,Marlett.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:ArialMT.FamilyName:Arial.StyleName:Regular.MenuName:Arial.StyleBits:0.WeightClass:400.WidthClass:5.AngleClass:0.FullName:Arial.WritingScript:Roman.WinName:Arial.FileLength:1036584.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial.NameArray:0,Win,1,Arial.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Arial-BoldMT.FamilyName:Arial.StyleName:Bold.MenuName:Arial.StyleBits:2.WeightClass:700.WidthClass:5.AngleClass:0.FullName:Arial Bold.WritingScript:Roman.WinName:Arial Bold.FileLength:980756.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial Bold.NameAr

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	157443
Entropy (8bit):	5.172039478677
Encrypted:	false
SSDEEP:	1536:amNTjRlaRlQShhp2VpMKRhWa11quVJzlzofqG9Z0ADWp1ttawvayKLWbVG3+2:RNj3aRlQShhp2VpMKRhWa11quVJX2
MD5:	A2C6972A1A9506ACE991068D7AD37098
SHA1:	BF4D2684587CF034BCFC6F74CED551F9E5316440
SHA-256:	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65
SHA-512:	4D03884CA5D1652A79E6D55D8F92F4D138C47D462E05C3E6A685DA6742E98841D9C63720727203B913A179892C413BFB33C05416E1675E0CF80DA98BE90BA5E4
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Marlett.FamilyName:Marlett.StyleName:Regular.MenuName:Marlett.StyleBits:0.WeightClass:500.WidthClass:5.AngleClass:0.FullName:Marlett.WritingScript:Roman.WinName:Marlett.FileLength:27724.NameArray:0,Win,1,Marlett.NameArray:0,Mac,4,Marlett.NameArray:0,Win,1,Marlett.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:ArialMT.FamilyName:Arial.StyleName:Regular.MenuName:Arial.StyleBits:0.WeightClass:400.WidthClass:5.AngleClass:0.FullName:Arial.WritingScript:Roman.WinName:Arial.FileLength:1036584.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial.NameArray:0,Win,1,Arial.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Arial-BoldMT.FamilyName:Arial.StyleName:Bold.MenuName:Arial.StyleBits:2.WeightClass:700.WidthClass:5.AngleClass:0.FullName:Arial Bold.WritingScript:Roman.WinName:Arial Bold.FileLength:980756.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial Bold.NameAr

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2830
Entropy (8bit):	4.922007049110223
Encrypted:	false
SSDEEP:	48:boMtfZ4H4Gb44G44Gpu4GrmWW4G44Gpe4GbS4GZ4GQ4GN4G44G44Gm74G44GF4GS:boMhZEo8Q+D8QvSVcB88g8x8gDhTEaQ
MD5:	43A34970D923802E7676A54E5F11DBC1
SHA1:	588AA09CEC4E843CD54CD6C2E0E307CE7EAD151B
SHA-256:	DE666E3DFBB7A24D7ABA85A80F3E5576E8D10774D505D1838D58EC07ABEB75B6
SHA-512:	6511E97C267D6535DEDA21AA8B3C358FDB3600058FAF8765CFBEEF6B9B5F9A9157B63F36AFD78C3EAFB3A6EFE7A885C371A0A4C93AB8DA6C98EEE4018490EE25
Malicious:	false
Preview:	03/02/2023 9:02 PM: Unpack: C:\Users\user\Downloads\Mar_02_Contract_19.zip..03/02/2023 9:02 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\m1vyocb5.3zt..03/02/2023 9:02 PM: Received from standard error: ERROR: Wrong password : Mar_02_Contract_19.iso..03/02/2023 9:02 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..03/02/2023 9:02 PM: Received from standard out: ..03/02/2023 9:02 PM: Received from standard out: Scanning the drive for archives:..03/02/2023 9:02 PM: Received from standard out: 1 file, 165482 bytes (162 KiB)..03/02/2023 9:02 PM: Received from standard out: ..03/02/2023 9:02 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\Mar_02_Contract_19.zip..03/02/2023 9:02 PM: Received from standard out: --..03/02/2023 9:02 PM: Received from standard out: Path = C:\Users\user\Downloads\Mar_02_Contract_19.zip..03/02/2023 9:02 PM: Received from standard out: Type = zip..03/02/2023 9:02 PM: Received from s

C:\Users\user\Downloads\38847957-19ee-4bd9-9f9e-362dfad892e0.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	165482
Entropy (8bit):	7.998649458596178
Encrypted:	true
SSDEEP:	3072:lWtvi137cJhFLArXqdTUR+DuGNwngBCTIxCgWovf8QFY4OLB:la47cJrLALpR+DuGNwgM5gCQQ
MD5:	8854C9740853DA2125F643E3B06215AF
SHA1:	D0B7CC1712B147584F5F7ACD79D6810F4572AF31
SHA-256:	DCEB464D637F20EEAA69D31AE6ADAE27B12D73D0451C8CCA00BBE36393FAAE11
SHA-512:	D67DDC3014D7CACD9F2C659FCB41256709B854FB6A761414D4F5ECFECEDDB2FAFBAA42FAC0C76B348C046863F89B38B9E601FDC76A7BA09F6225E7074A579557
Malicious:	false
Preview:	PK.........cbVO5$-............Mar_02_Contract_19.iso.<C...........TC7Z.....[0.SN>.(.f....n~...F.........."V..Pc..}...;...t......qa.V."..y.n_....D..$..DS.....a.\|......./..Pl..?v.&.Mz.n.MA........{X.}.N...6.i.....6WJ.bj.....2;.\|1BS.-.u.6...E<....8..e2.9g{_......87.e.a.%. ... f.....\...(.^..>....%$p.j..=j.....a[/.wx..Q.>...P.......!.'ctG...i...r.......?`>dh2.....2..?....B..z8._...... <f.......1)ro...H.s].f...E...............*.uh....D.P..."fk:p....../[]/..t.d$..f.9......b=.......)...J..5]...S.......>r..%.&.......x..D...<.#....].uZ4...........j.....UB...p.....j...S......Sr_.x.F..d./..w..\].T.u.....fO(.#L...e..L.@....S.&Y.[.hu.. .......oP...$l..y..z.4.....Cv...i...R.EI..).7E..R...}(.k.U8.<.8....4Ab..\...R.}.^.\|H..p...?..V..TBU..,.]P.......S....U.?.k!.X.....y9.V...G..6'..<./....T.-4-.<G...^..Kn=u........5.%..K.......G..)......cv.8..&....j...e_.c......8.I.).....~$E.R..A..y=..E..z....P"d..A..{M....?a!..<-]....a.<.+b.`]P....>.2..N...#..rFu..M.

C:\Users\user\Downloads\Mar_02_Contract_19.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	165482
Entropy (8bit):	7.998649458596178
Encrypted:	true
SSDEEP:	3072:lWtvi137cJhFLArXqdTUR+DuGNwngBCTIxCgWovf8QFY4OLB:la47cJrLALpR+DuGNwgM5gCQQ
MD5:	8854C9740853DA2125F643E3B06215AF
SHA1:	D0B7CC1712B147584F5F7ACD79D6810F4572AF31
SHA-256:	DCEB464D637F20EEAA69D31AE6ADAE27B12D73D0451C8CCA00BBE36393FAAE11
SHA-512:	D67DDC3014D7CACD9F2C659FCB41256709B854FB6A761414D4F5ECFECEDDB2FAFBAA42FAC0C76B348C046863F89B38B9E601FDC76A7BA09F6225E7074A579557
Malicious:	false
Preview:	PK.........cbVO5$-............Mar_02_Contract_19.iso.<C...........TC7Z.....[0.SN>.(.f....n~...F.........."V..Pc..}...;...t......qa.V."..y.n_....D..$..DS.....a.\|......./..Pl..?v.&.Mz.n.MA........{X.}.N...6.i.....6WJ.bj.....2;.\|1BS.-.u.6...E<....8..e2.9g{_......87.e.a.%. ... f.....\...(.^..>....%$p.j..=j.....a[/.wx..Q.>...P.......!.'ctG...i...r.......?`>dh2.....2..?....B..z8._...... <f.......1)ro...H.s].f...E...............*.uh....D.P..."fk:p....../[]/..t.d$..f.9......b=.......)...J..5]...S.......>r..%.&.......x..D...<.#....].uZ4...........j.....UB...p.....j...S......Sr_.x.F..d./..w..\].T.u.....fO(.#L...e..L.@....S.&Y.[.hu.. .......oP...$l..y..z.4.....Cv...i...R.EI..).7E..R...}(.k.U8.<.8....4Ab..\...R.}.^.\|H..p...?..V..TBU..,.]P.......S....U.?.k!.X.....y9.V...G..6'..<./....T.-4-.<G...^..Kn=u........5.%..K.......G..)......cv.8..&....j...e_.c......8.I.).....~$E.R..A..y=..E..z....P"d..A..{M....?a!..<-]....a.<.+b.`]P....>.2..N...#..rFu..M.

C:\Users\user\Downloads\Mar_02_Contract_19.zip.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	165482
Entropy (8bit):	7.998649458596178
Encrypted:	true
SSDEEP:	3072:lWtvi137cJhFLArXqdTUR+DuGNwngBCTIxCgWovf8QFY4OLB:la47cJrLALpR+DuGNwgM5gCQQ
MD5:	8854C9740853DA2125F643E3B06215AF
SHA1:	D0B7CC1712B147584F5F7ACD79D6810F4572AF31
SHA-256:	DCEB464D637F20EEAA69D31AE6ADAE27B12D73D0451C8CCA00BBE36393FAAE11
SHA-512:	D67DDC3014D7CACD9F2C659FCB41256709B854FB6A761414D4F5ECFECEDDB2FAFBAA42FAC0C76B348C046863F89B38B9E601FDC76A7BA09F6225E7074A579557
Malicious:	false
Preview:	PK.........cbVO5$-............Mar_02_Contract_19.iso.<C...........TC7Z.....[0.SN>.(.f....n~...F.........."V..Pc..}...;...t......qa.V."..y.n_....D..$..DS.....a.\|......./..Pl..?v.&.Mz.n.MA........{X.}.N...6.i.....6WJ.bj.....2;.\|1BS.-.u.6...E<....8..e2.9g{_......87.e.a.%. ... f.....\...(.^..>....%$p.j..=j.....a[/.wx..Q.>...P.......!.'ctG...i...r.......?`>dh2.....2..?....B..z8._...... <f.......1)ro...H.s].f...E...............*.uh....D.P..."fk:p....../[]/..t.d$..f.9......b=.......)...J..5]...S.......>r..%.&.......x..D...<.#....].uZ4...........j.....UB...p.....j...S......Sr_.x.F..d./..w..\].T.u.....fO(.#L...e..L.@....S.&Y.[.hu.. .......oP...$l..y..z.4.....Cv...i...R.EI..).7E..R...}(.k.U8.<.8....4Ab..\...R.}.^.\|H..p...?..V..TBU..,.]P.......S....U.?.k!.X.....y9.V...G..6'..<./....T.-4-.<G...^..Kn=u........5.%..K.......G..)......cv.8..&....j...e_.c......8.I.).....~$E.R..A..y=..E..z....P"d..A..{M....?a!..<-]....a.<.+b.`]P....>.2..N...#..rFu..M.

\Device\ConDrv

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.323438059425305
Encrypted:	false
SSDEEP:	6:PHNK5GGbmWLi0e//EALLIfdk+vojm+VYK+KuRsM0Fq+5RxZpGAXA5DaBoEYv:PNKYMLPekALElkzjm+VYKduiXFq+5nnO
MD5:	063D76472E96A7496B67070C2FCBD0E8
SHA1:	FD3CD795D1DC417AC69C428F65745EAAD374D93A
SHA-256:	79870032DE3A750F475B25F9EC4CC43CDE32014BEDC4BD5C97A77CF824544140
SHA-512:	B80140BD35C1315E19AF506DB13578A8F6FFB35A6D13329BFB7607A236FCD07CCF44713411DDC62873BB07EDF0B53F504772C6E5EF31F299B276369CE89F2B33
Malicious:	false
Preview:	[1112:4108:0302/210252.583:ERROR:external_registry_loader_win.cc(144)] Missing value path for key Software\Google\Chrome\Extensions\efaidnbmnnnibpcajpcglclefindmkaj...[1112:3600:0302/210256.083:ERROR:device_event_log_impl.cc(214)] [21:02:56.118] Bluetooth: bluetooth_adapter_winrt.cc:1074 Getting Default Adapter failed...

Static File Info

General

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.946919594980857
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Mar_02_Contract_12.pdf
File size:	35167
MD5:	0e672cfd6083d74fb5a0be79346a52db
SHA1:	9a66963325418ece8dee9630fee84291f83361e7
SHA256:	56734da861a7d95f690e0172e717cc933513e37677c18c9277a2a261e55090ac
SHA512:	87faf62804dd968f4281214aed99ae13b08dbc0a471fc58c38ad2b128ba05634c243e876e99a8dca38a496082103699947b1423acdaba1be27af907bf8b0777d
SSDEEP:	768:roH8rsL6BrMgyy2teSsC3aPzMUiui/h215YqBFymZ+8Ag:rzBrM/yzKaPI730VL+g
TLSH:	95F2F119DAA06E95DDC28178703C5FB0AED8352179CA3742DA49B05AB1402FE7F693F2
File Content Preview:	%PDF-1.4.%.....1 0 obj.<</Alternate/DeviceRGB/N 3/Length 247/Filter/FlateDecode>>stream.x.c``<...,....y%EA.N...Q..H 1....7`d`.v.D20\......LI-N....X..h9.H. [$...... l............B..... [#.....N.(.....mrsJ...f.I......@,.P..........".........bI3....20H.B..,`

File Icon


Icon Hash:	74ecccdcd4ccccf0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.946920
Total Bytes:	35167
Stream Entropy:	7.952244
Stream Bytes:	33829
Entropy outside Streams:	5.372458
Bytes outside Streams:	1338
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	8
endobj	8
stream	3
endstream	3
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
2	604c8f4e31014e60	4e4fcc7298ca872d8fadf444d64cc3e3

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 2, 2023 21:02:55.117336988 CET	49700	443	192.168.2.3	142.250.203.109
Mar 2, 2023 21:02:55.117419958 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:55.117536068 CET	49700	443	192.168.2.3	142.250.203.109
Mar 2, 2023 21:02:55.118068933 CET	49700	443	192.168.2.3	142.250.203.109
Mar 2, 2023 21:02:55.118113995 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:55.128024101 CET	49703	443	192.168.2.3	142.250.203.110
Mar 2, 2023 21:02:55.128062963 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.128123999 CET	49703	443	192.168.2.3	142.250.203.110
Mar 2, 2023 21:02:55.144645929 CET	49703	443	192.168.2.3	142.250.203.110
Mar 2, 2023 21:02:55.144684076 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.189853907 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:55.190351009 CET	49700	443	192.168.2.3	142.250.203.109
Mar 2, 2023 21:02:55.190401077 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:55.191737890 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:55.191840887 CET	49700	443	192.168.2.3	142.250.203.109
Mar 2, 2023 21:02:55.224634886 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.239739895 CET	49703	443	192.168.2.3	142.250.203.110
Mar 2, 2023 21:02:55.239808083 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.240724087 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.240838051 CET	49703	443	192.168.2.3	142.250.203.110
Mar 2, 2023 21:02:55.242527962 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.242641926 CET	49703	443	192.168.2.3	142.250.203.110
Mar 2, 2023 21:02:55.526798964 CET	49703	443	192.168.2.3	142.250.203.110
Mar 2, 2023 21:02:55.526834965 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.527097940 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.528213978 CET	49703	443	192.168.2.3	142.250.203.110
Mar 2, 2023 21:02:55.528242111 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.536485910 CET	49700	443	192.168.2.3	142.250.203.109
Mar 2, 2023 21:02:55.536561012 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:55.536951065 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:55.537791967 CET	49700	443	192.168.2.3	142.250.203.109
Mar 2, 2023 21:02:55.537851095 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:55.564347982 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.564526081 CET	49703	443	192.168.2.3	142.250.203.110
Mar 2, 2023 21:02:55.564553976 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.564690113 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.564811945 CET	49703	443	192.168.2.3	142.250.203.110
Mar 2, 2023 21:02:55.567024946 CET	49703	443	192.168.2.3	142.250.203.110
Mar 2, 2023 21:02:55.567050934 CET	443	49703	142.250.203.110	192.168.2.3
Mar 2, 2023 21:02:55.591645002 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:55.591751099 CET	49700	443	192.168.2.3	142.250.203.109
Mar 2, 2023 21:02:55.591785908 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:55.592061043 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:55.592164040 CET	49700	443	192.168.2.3	142.250.203.109
Mar 2, 2023 21:02:55.594386101 CET	49700	443	192.168.2.3	142.250.203.109
Mar 2, 2023 21:02:55.594408989 CET	443	49700	142.250.203.109	192.168.2.3
Mar 2, 2023 21:02:57.842812061 CET	49705	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:02:57.842864037 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:02:57.842961073 CET	49705	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:02:57.843271017 CET	49705	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:02:57.843297005 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:02:57.908199072 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:02:57.908782959 CET	49705	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:02:57.908828974 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:02:57.911329031 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:02:57.911487103 CET	49705	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:02:57.915724039 CET	49705	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:02:57.915757895 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:02:57.916004896 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:02:57.965374947 CET	49705	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:02:57.965428114 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:02:58.065403938 CET	49705	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:03:07.911456108 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:03:07.911537886 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:03:07.911726952 CET	49705	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:03:52.916470051 CET	49705	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:03:52.916527033 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:03:57.904716015 CET	49705	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:03:57.904753923 CET	443	49705	142.250.203.100	192.168.2.3
Mar 2, 2023 21:03:57.905236006 CET	49719	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:03:57.905301094 CET	443	49719	142.250.203.100	192.168.2.3
Mar 2, 2023 21:03:57.905493975 CET	49719	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:03:57.905894041 CET	49719	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:03:57.905913115 CET	443	49719	142.250.203.100	192.168.2.3
Mar 2, 2023 21:03:57.960017920 CET	443	49719	142.250.203.100	192.168.2.3
Mar 2, 2023 21:03:57.960611105 CET	49719	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:03:57.960654020 CET	443	49719	142.250.203.100	192.168.2.3
Mar 2, 2023 21:03:57.961147070 CET	443	49719	142.250.203.100	192.168.2.3
Mar 2, 2023 21:03:57.965637922 CET	49719	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:03:57.965676069 CET	443	49719	142.250.203.100	192.168.2.3
Mar 2, 2023 21:03:57.965850115 CET	443	49719	142.250.203.100	192.168.2.3
Mar 2, 2023 21:03:58.008841991 CET	49719	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:04:07.951750040 CET	443	49719	142.250.203.100	192.168.2.3
Mar 2, 2023 21:04:07.951920033 CET	443	49719	142.250.203.100	192.168.2.3
Mar 2, 2023 21:04:07.952188015 CET	49719	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:04:52.959101915 CET	49719	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:04:52.959163904 CET	443	49719	142.250.203.100	192.168.2.3
Mar 2, 2023 21:05:37.963788033 CET	49719	443	192.168.2.3	142.250.203.100
Mar 2, 2023 21:05:37.963857889 CET	443	49719	142.250.203.100	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 2, 2023 21:02:55.090410948 CET	57990	53	192.168.2.3	8.8.8.8
Mar 2, 2023 21:02:55.090940952 CET	52387	53	192.168.2.3	8.8.8.8
Mar 2, 2023 21:02:55.110173941 CET	53	52387	8.8.8.8	192.168.2.3
Mar 2, 2023 21:02:55.117330074 CET	53	57990	8.8.8.8	192.168.2.3
Mar 2, 2023 21:02:57.820534945 CET	51139	53	192.168.2.3	8.8.8.8
Mar 2, 2023 21:02:57.840884924 CET	53	51139	8.8.8.8	192.168.2.3
Mar 2, 2023 21:03:57.880399942 CET	60767	53	192.168.2.3	8.8.8.8
Mar 2, 2023 21:03:57.899086952 CET	53	60767	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 2, 2023 21:02:55.090410948 CET	192.168.2.3	8.8.8.8	0x5183	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Mar 2, 2023 21:02:55.090940952 CET	192.168.2.3	8.8.8.8	0x12b2	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Mar 2, 2023 21:02:57.820534945 CET	192.168.2.3	8.8.8.8	0x4271	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 2, 2023 21:03:57.880399942 CET	192.168.2.3	8.8.8.8	0x39e0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 2, 2023 21:02:55.110173941 CET	8.8.8.8	192.168.2.3	0x12b2	No error (0)	accounts.google.com		142.250.203.109	A (IP address)	IN (0x0001)	false
Mar 2, 2023 21:02:55.117330074 CET	8.8.8.8	192.168.2.3	0x5183	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 2, 2023 21:02:55.117330074 CET	8.8.8.8	192.168.2.3	0x5183	No error (0)	clients.l.google.com		142.250.203.110	A (IP address)	IN (0x0001)	false
Mar 2, 2023 21:02:57.840884924 CET	8.8.8.8	192.168.2.3	0x4271	No error (0)	www.google.com		142.250.203.100	A (IP address)	IN (0x0001)	false
Mar 2, 2023 21:03:57.899086952 CET	8.8.8.8	192.168.2.3	0x39e0	No error (0)	www.google.com		142.250.203.100	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

clients2.google.com

accounts.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49703	142.250.203.110	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-02 20:02:55 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-02 20:02:55 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-wayGwwsdSXBrlqJ6UsXVzQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Mar 2023 20:02:55 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5904 X-Daystart: 43375 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-03-02 20:02:55 UTC	1	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 39 30 34 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 33 33 37 35 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5904" elapsed_seconds="43375"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-03-02 20:02:55 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-03-02 20:02:55 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49700	142.250.203.109	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-02 20:02:55 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg
2023-03-02 20:02:55 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-03-02 20:02:55 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Mar 2023 20:02:55 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-wvTyq5D02xvvuDSXmwxq6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-03-02 20:02:55 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-03-02 20:02:55 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	21:02:25
Start date:	02/03/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Mar_02_Contract_12.pdf
Imagebase:	0x12d0000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	1
Start time:	21:02:31
Start date:	02/03/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0x280000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	4
Start time:	21:02:50
Start date:	02/03/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	21:02:51
Start date:	02/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	21:02:52
Start date:	02/03/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 --field-trial-handle=1880,i,15371601189275763345,10103813945144653960,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	21:02:52
Start date:	02/03/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firebasestorage.googleapis.com/v0/b/dulcet-bonito-377702.appspot.com/o/NjbqZi57b9%2FMar_02_Contract_19.zip?alt=media&token=26aff41a-e640-4741-9b66-c3821f31a7d0
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	21:02:56
Start date:	02/03/2023
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Mar_02_Contract_19.zip
Imagebase:	0x850000
File size:	12800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Target ID:	10
Start time:	21:02:56
Start date:	02/03/2023
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\m1vyocb5.3zt" "C:\Users\user\Downloads\Mar_02_Contract_19.zip
Imagebase:	0x900000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	12
Start time:	21:02:57
Start date:	02/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Execution Graph

Execution Coverage:	20.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0103B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0103B208

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: a11d059cc1c92336e77d0c12f97ab915ca5203adae483c5a3fdfe769a229b01c
Instruction ID: 46fdbc3297eb0795cc691f30e772447ac02e04dfb69b60bc487b22e671bed3d6
Opcode Fuzzy Hash: a11d059cc1c92336e77d0c12f97ab915ca5203adae483c5a3fdfe769a229b01c
Instruction Fuzzy Hash: 5F01D1348042409FDB10CF65E888769FBE8EF84624F08C5ABDD888F306D378A444CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A00798 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@D`, xrefs: 02A008B5
:@D`, xrefs: 02A00822
X1k`, xrefs: 02A00966

Memory Dump Source

Source File: 00000009.00000002.693460831.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_unarchiver.jbxd

Similarity

API ID:
String ID: :@D`$:@D`$X1k`
API String ID: 0-3456691157
Opcode ID: 76e0757dbafd766e3d28f83c4204afb7288d3a7e1813d27362a16e995f39bfed
Instruction ID: 90c85bdf13f79264591fdd1745272ebf2b9796bbb502d3012b5f325a01f170a2
Opcode Fuzzy Hash: 76e0757dbafd766e3d28f83c4204afb7288d3a7e1813d27362a16e995f39bfed
Instruction Fuzzy Hash: 0DA16E34B002159BDB18AB74D4A576EB7E7FFD4308F148828E9059B394EF799C42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0103B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0103B2F3

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 94ef3879014760887f53674ade2234d2f5ebb9e8e6ddb0edfd31fccb2fd29977
Instruction ID: 08574d4a529383dfece81576a760cd06080ecb7e0e71fe5837d660d51438bd22
Opcode Fuzzy Hash: 94ef3879014760887f53674ade2234d2f5ebb9e8e6ddb0edfd31fccb2fd29977
Instruction Fuzzy Hash: A331C6714043446FEB128F61DC45F66BFFCEF45314F0484AAE981DB152D324A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0103AB76 Relevance: 1.6, APIs: 1, Instructions: 99
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0103AC36

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 23f6f2e934deaab1307c3a14d306b5e301f031184d08a82c8e49367b745782c6
Instruction ID: 7a857d4aa7a9164af85caaff8dcdb126d9477fd0b0779d5864b7f6566e537ba5
Opcode Fuzzy Hash: 23f6f2e934deaab1307c3a14d306b5e301f031184d08a82c8e49367b745782c6
Instruction Fuzzy Hash: 3831816640E7C06FD7038B719C65A61BFB4AF87610F1E84DBD8C4CF1A3D269A809C762

Uniqueness

Uniqueness Score: -1.00%

Function 0103AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0103ADA7

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5c32babfaa673f2e4688bcc280a7e842a91587465a2495ede90310fa05580942
Instruction ID: 64bfc9f1c2fc326065d028f23b7705c2aac31255368b3b3c78bb819af1041f9d
Opcode Fuzzy Hash: 5c32babfaa673f2e4688bcc280a7e842a91587465a2495ede90310fa05580942
Instruction Fuzzy Hash: 5831B5715043856FEB228F65DC44F67FBECEF85210F0488AEF985DB152D224A945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0103A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0103A67D

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b8b7b7092569deb44b39ff3eff2e78544c0b2f16900e8352299a3652b3a09c7d
Instruction ID: 80eab197e97d300983695c05dc646cf27f382e186300f2ae7b4fd3323b9bfc34
Opcode Fuzzy Hash: b8b7b7092569deb44b39ff3eff2e78544c0b2f16900e8352299a3652b3a09c7d
Instruction Fuzzy Hash: F5317E71504340AFE722CF65CC44F66FFE8EF89220F08849EE9858B252D375E809CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0103A120 Relevance: 1.6, APIs: 1, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0103A1C2

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 39c9acac67cfc3ecdb130795ff0b4fb60f0cbda5eae965f6ba995214c055babd
Instruction ID: 33100e76b3b58903543f6ca7f0b2439a1152c06d660204a75fccba1d558d37e9
Opcode Fuzzy Hash: 39c9acac67cfc3ecdb130795ff0b4fb60f0cbda5eae965f6ba995214c055babd
Instruction Fuzzy Hash: D721A17140D3C06FD7128B35CC55BA2BFB4EF87620F1985DBD8848F293D225A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0103AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0103ADA7

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bcd811ae4e6536c577779a709a4d6826ee23dc0e587d0a8ae433b9f8cfa26327
Instruction ID: c98c4c2081878da833d7a7bcc09fca3a022dd23930ec21353369ada815b0a138
Opcode Fuzzy Hash: bcd811ae4e6536c577779a709a4d6826ee23dc0e587d0a8ae433b9f8cfa26327
Instruction Fuzzy Hash: F721B272500205AFEB219F64DC88F6BF7ECEF84224F04C86AE985DB551D730A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0103A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,D9814238,00000000,00000000,00000000,00000000), ref: 0103A40C

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a166b91ad2d1e41bd46f5733b8121d8cf2c6ca6986cef0193fe0a31a332f1fca
Instruction ID: 146c3bc06a341a06e3c690c68251edfc6372f26b2fd8afd8169ddf218511fff5
Opcode Fuzzy Hash: a166b91ad2d1e41bd46f5733b8121d8cf2c6ca6986cef0193fe0a31a332f1fca
Instruction Fuzzy Hash: 5D216D76604340AFE721CF55CC84F52BBECAF85610F08C49AE985DB252D364E949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0103B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0103B2F3

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7cff478aaaeb1b60a365ea3b8dc3fae2226f24881a01d85cf4f3824184c51dd7
Instruction ID: 277c7f6d87995d9ae41901565c6880dcb97c8f46ae6eb55e65962b40381d920b
Opcode Fuzzy Hash: 7cff478aaaeb1b60a365ea3b8dc3fae2226f24881a01d85cf4f3824184c51dd7
Instruction Fuzzy Hash: D721C172500205AFEB219F65DC84F6AF7ECEF84314F04C86AED85DB251D370E9448BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0103A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,D9814238,00000000,00000000,00000000,00000000), ref: 0103A8DE

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f45a4f6a9121181f1d9cfe45a4aeb40dabdf1ee9d05a71ad797397793142a590
Instruction ID: b6a2539e5ed96c91b8296fe15c87d071a39c78dc01a9fa32d27823676f141e92
Opcode Fuzzy Hash: f45a4f6a9121181f1d9cfe45a4aeb40dabdf1ee9d05a71ad797397793142a590
Instruction Fuzzy Hash: BD21B271408380AFEB128F64DC84F62BFB8EF86614F09C4EBE984DF152C264A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 0103A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,D9814238,00000000,00000000,00000000,00000000), ref: 0103A9C1

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b635c44ad94058bcd2255f5786c3e8e954cb9690b764d0c8f6e82de5a8a05cd2
Instruction ID: 255640254b91665fa2003faab2f2e5a3f5279ff27d41acabd566fb0ec9e29484
Opcode Fuzzy Hash: b635c44ad94058bcd2255f5786c3e8e954cb9690b764d0c8f6e82de5a8a05cd2
Instruction Fuzzy Hash: 2B219C71409380AFDB228F65DC84F96FFB8EF46210F08849AE9849F162C264A549CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0103A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0103A67D

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9b69aaced4e79734fd5cabf50c0805ef7d13ef74abb754cea2b4c91941a49148
Instruction ID: 5ee0abf44cfaee2fc21b9068b3333f96135ea8d7a773f5c7520a4d80191788b5
Opcode Fuzzy Hash: 9b69aaced4e79734fd5cabf50c0805ef7d13ef74abb754cea2b4c91941a49148
Instruction Fuzzy Hash: 74219075600200EFEB21DF65DD84F66FBE8EF88614F08846EE985CB252D375E404CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0103A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,D9814238,00000000,00000000,00000000,00000000), ref: 0103A815

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 62cfd3fdc381ededd6f04b6ead88e79445bfee57c271ee9d3c9b94ea1f0c7031
Instruction ID: da1aa05d6f7c783daf46db5dc8303676e55c762d2005261d5850ca1f60882817
Opcode Fuzzy Hash: 62cfd3fdc381ededd6f04b6ead88e79445bfee57c271ee9d3c9b94ea1f0c7031
Instruction Fuzzy Hash: D921C3B54093806FE7128B61DC81BA2BFA8EF86714F08C0DBE9849B153D264A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 0103A6D4 Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0103A748

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: fded2c7f2d9404800f6309646f59ccf40cf66ea49a669cd68d93bebb80ec4bb6
Instruction ID: 8ca243e78c1ce16f158de011c4bd36440a62a4e1a598b21ce4306c3fe6378677
Opcode Fuzzy Hash: fded2c7f2d9404800f6309646f59ccf40cf66ea49a669cd68d93bebb80ec4bb6
Instruction Fuzzy Hash: 6921C5B550A3C05FDB138F25DC95752BFB8AF07220F0980DBDD858F2A3D1645909C761

Uniqueness

Uniqueness Score: -1.00%

Function 0103AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0103AA8B

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 2337b2a74e4acfd2243d947088f7758fd9b5deb3e63ad850840cb9ac65ae4a68
Instruction ID: 1f9b2e16e6c685cb5b1eacc4ce52ceaf14677d9a1cb6caf0f8a1d3494a1a3690
Opcode Fuzzy Hash: 2337b2a74e4acfd2243d947088f7758fd9b5deb3e63ad850840cb9ac65ae4a68
Instruction Fuzzy Hash: 8121B0725087C09FEB12CB69DC55B92BFE8AF46224F0D80EAE984CF153D325D949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0103A392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,D9814238,00000000,00000000,00000000,00000000), ref: 0103A40C

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bc717698944eec1565c227704b08b68fd39b138066876643e2e41f0be55b7f98
Instruction ID: 37e0dc37286972e7902f441b71e1cfd0510e1093264ac6528b6d8cfbe5ba7d03
Opcode Fuzzy Hash: bc717698944eec1565c227704b08b68fd39b138066876643e2e41f0be55b7f98
Instruction Fuzzy Hash: 10218E75600204AEEB20CE55CC84F66F7ECEF84710F04C4AAED85DB251D764E949CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0103A962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,D9814238,00000000,00000000,00000000,00000000), ref: 0103A9C1

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 942f405e29de2515204a63131bcba53aeeac595b779a485171980d35a42d3589
Instruction ID: 78d92608deaf8dbbb2c386b9898b188cd92d987ae422ee4041a4a6482775e42b
Opcode Fuzzy Hash: 942f405e29de2515204a63131bcba53aeeac595b779a485171980d35a42d3589
Instruction Fuzzy Hash: 5F11B275500200AFEB21DF65DC84F5AFBE8EF84624F04C56BED859B251C374A544CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0103A882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E2C,D9814238,00000000,00000000,00000000,00000000), ref: 0103A8DE

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: faedce6f65d4dc714fcfac387dcefe7deec8c4ea4d65f54cf9a6a70908481f1f
Instruction ID: 5c695f022ffeae84fb6c8f4fd96e13c6cc12188c84219f410b5e7063169ab5b5
Opcode Fuzzy Hash: faedce6f65d4dc714fcfac387dcefe7deec8c4ea4d65f54cf9a6a70908481f1f
Instruction Fuzzy Hash: 3F11C475500200AEEB21DF54DC84F56F7E8EF84620F04C8ABED85DB251C374A545CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0103A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0103A30C

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c612e2aac96d5de4e09ecbef5933e1ef673930496c38883e072b3b2ce86c25fb
Instruction ID: ee7ff2caa68f01d0d01f4fb146f1421b75a7ebed224d29c748f604c63d16ea36
Opcode Fuzzy Hash: c612e2aac96d5de4e09ecbef5933e1ef673930496c38883e072b3b2ce86c25fb
Instruction Fuzzy Hash: 661191754093C09FDB228B25DC54A52BFB4DF47220F09C0DBED848F263D265A849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0103AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0103AFE4

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 7693ccfb596fe40dcecb22a44f070be97d319ff99981bda38efab1d77d0597fd
Instruction ID: c4fd2e52560a50fe41e3034b867dc82ac104e43b378071867b7d6d8b57f66202
Opcode Fuzzy Hash: 7693ccfb596fe40dcecb22a44f070be97d319ff99981bda38efab1d77d0597fd
Instruction Fuzzy Hash: 86119E754093C09FDB228B29DC45B52FFF8EF46220F0984DBED858B263D274A848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0103B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0103B208

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: a0799e2fd998971403ddc4b44d3bab7c3a63effad5130c90c736357bf047ccf0
Instruction ID: 9891530c109dea3df9cf52adaeb3e7a2f1fd905914397073bbde7634a0793f5d
Opcode Fuzzy Hash: a0799e2fd998971403ddc4b44d3bab7c3a63effad5130c90c736357bf047ccf0
Instruction Fuzzy Hash: 94115E754093809FDB128F25DC44B56BFA4DF56224F0884EAED888F252D279A548CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0103A7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,D9814238,00000000,00000000,00000000,00000000), ref: 0103A815

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f1fc332c45e283a0afc345b3d8ad6e789310c2c9a10459930aca3e5d3fe183e7
Instruction ID: c8451164de3ca4255e367c8e7f7c3d0581a5efcec4e35b8540b1689c00646dd6
Opcode Fuzzy Hash: f1fc332c45e283a0afc345b3d8ad6e789310c2c9a10459930aca3e5d3fe183e7
Instruction Fuzzy Hash: FD012635500200AEE720DF15DC84F66F7ECDF84720F04C0AAED849B241D374A9458BB2

Uniqueness

Uniqueness Score: -1.00%

Function 0103AA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0103AA8B

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 5f56ca8137d79478c122cca63b53075955794fb48e9650472569cae6cf890f40
Instruction ID: e177285a1a17459f65dd046f9c694055fdcd590725820a27cfcb67629e3875c2
Opcode Fuzzy Hash: 5f56ca8137d79478c122cca63b53075955794fb48e9650472569cae6cf890f40
Instruction Fuzzy Hash: 0411A172600640DFEB50CF69D984B56FBECEF44620F08C4AAED89CB242E374E445CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0103ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0103AC36

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: c243f6eaaa6ee9908a79f4c18e8fa9fcd3a61e1ab0683015403cdc79aee60e56
Instruction ID: 3ea2c65686cf7ee593c46cfaf95c5c54549b9f718abc33244e3f413d56536f87
Opcode Fuzzy Hash: c243f6eaaa6ee9908a79f4c18e8fa9fcd3a61e1ab0683015403cdc79aee60e56
Instruction Fuzzy Hash: 8901B171900200ABD310DF26DC85B26FBA8FBC8A20F14C12AED089B741D231B915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0103A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0103A1C2

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 40cac741323e887d7aeb9d1330e36431b82d5dfef8218bec2219754419be127f
Instruction ID: d4dd0875a358df6563f75d4355b12eeb985b136eead55b348b1d0d4dc7e51d44
Opcode Fuzzy Hash: 40cac741323e887d7aeb9d1330e36431b82d5dfef8218bec2219754419be127f
Instruction Fuzzy Hash: 97017C71940200ABD710DF26DC86B26FBA8FBC8A20F14856AED089B741E275B955CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0103A716 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0103A748

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7ceb10e0d7c09ce3b78c6e78dfd963aa0d2380db96052a6bddcb4a1d74820415
Instruction ID: e738021d84e46c81fdfa2850790b8e29a2ac0725e756a0601e7ce74039eec1bf
Opcode Fuzzy Hash: 7ceb10e0d7c09ce3b78c6e78dfd963aa0d2380db96052a6bddcb4a1d74820415
Instruction Fuzzy Hash: 1C018475A04240DFDB118F25DC85755FBE8EF54620F08C4ABDD86CF356D278A444CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0103AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0103AFE4

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 42036aa1a7e99249076599033f107c19b0c8fd3942dd67156a539163bee5250a
Instruction ID: 04687aece65864ecc678b18b792dc15088ff675fb15532b2268d494da780a1ba
Opcode Fuzzy Hash: 42036aa1a7e99249076599033f107c19b0c8fd3942dd67156a539163bee5250a
Instruction Fuzzy Hash: 8A01D175A002408FDB108F29D884766FBE8EF44624F08C0ABED858B356D275E448CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A002C0 Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

e]H`^, xrefs: 02A002F2, 02A002F7

Memory Dump Source

Source File: 00000009.00000002.693460831.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_unarchiver.jbxd

Similarity

API ID:
String ID: e]H`^
API String ID: 0-2963878696
Opcode ID: e0beeca4e59ff90ac4d3eb8e483c73138da27ff034defdb8a3bbab8b852185d3
Instruction ID: 8486f033fa37227e980ac69aa68f193498183323928ccf8d2dcf9a71f4cd7512
Opcode Fuzzy Hash: e0beeca4e59ff90ac4d3eb8e483c73138da27ff034defdb8a3bbab8b852185d3
Instruction Fuzzy Hash: 5CB13179701114EFC724EF64E5A8A5E7BB2FF98354B108528E5069B3A8DF359C01CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0103A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0103A30C

Memory Dump Source

Source File: 00000009.00000002.693191029.000000000103A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_103a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 200ec61437856c26e5b38a1b5083a3c0ca50fdf07e3c80e3f6c3bd5c16d2e111
Instruction ID: cabe462bb6d3ce5f0be498806e803434ac89189eacce81e62da74616f31a834d
Opcode Fuzzy Hash: 200ec61437856c26e5b38a1b5083a3c0ca50fdf07e3c80e3f6c3bd5c16d2e111
Instruction Fuzzy Hash: 9AF0AF34904240CFDB20CF15D884765FBE4EF84720F08C09AED898F356D3B9A448CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A00C99 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693460831.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5fd51807bc4e850cd6548bdeb96ba87eac197626913cc3370510294b7ff6a6d
Instruction ID: 1595deb2badfc1158500eaea1d99d92bf6bc0ee2916d8c7ff71444ee5649ea8c
Opcode Fuzzy Hash: c5fd51807bc4e850cd6548bdeb96ba87eac197626913cc3370510294b7ff6a6d
Instruction Fuzzy Hash: E02126B0B012445BCB01EB3584907AEBBD3AFE5604F44482DE485CB381DF35DE0687E2

Uniqueness

Uniqueness Score: -1.00%

Function 02A00CA8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693460831.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b58298afed7470395d43e385965f97b749e575acb9cf6d0b095aab30cf1fed
Instruction ID: 6936d620a3d284e5f03afee0e60ad85536c2342ab33d6aea0c045a3242713778
Opcode Fuzzy Hash: f0b58298afed7470395d43e385965f97b749e575acb9cf6d0b095aab30cf1fed
Instruction Fuzzy Hash: B021E4B0B007084BCB41EB3984906AEBBD7AFE5604B04882DD486CB381DF75E90687E2

Uniqueness

Uniqueness Score: -1.00%

Function 02A00BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693460831.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e0707a7a1a4f88e9581636415a20a82655cb69fe32636dbb93d49b71cf9d93
Instruction ID: b71ab996db142215ec10bd52be11c40a67fafa8288c36fbcb8fc8b68c85befb5
Opcode Fuzzy Hash: 79e0707a7a1a4f88e9581636415a20a82655cb69fe32636dbb93d49b71cf9d93
Instruction Fuzzy Hash: 78119E32A10118AFCF45ABB4D85599E7BE7FB88214B014875F206E7224EF71AC15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A207F8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693471269.0000000002A20000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a20000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7476f1d10ccdd2e74991dcc1d855d34dfee30df81639532bee3509939cbd2663
Instruction ID: b3d8ec78ac9c885a152e9305deffc71576e0cbbb12dcab9a8581ccf1c41d472a
Opcode Fuzzy Hash: 7476f1d10ccdd2e74991dcc1d855d34dfee30df81639532bee3509939cbd2663
Instruction Fuzzy Hash: BC0171B28093946FD702CF55EC45856FBF8DF86620B08C56EEC499B202D26669188BA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A205D1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693471269.0000000002A20000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a20000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4725826344c13cb0ed7f17830e3df1cbb850b1e008bd97b8a345a0465edb78
Instruction ID: 35b56f6048c4d145c0f11b6604cd4c2684950decb5f1516242d474c1e8fa7820
Opcode Fuzzy Hash: ca4725826344c13cb0ed7f17830e3df1cbb850b1e008bd97b8a345a0465edb78
Instruction Fuzzy Hash: 370186B65097806FD711CF16EC45862FFB8DB86520709C49FEC598B612D125A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 02A2087B Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693471269.0000000002A20000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a20000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5237c7af1ecc08f42767a8041ab5e12976ab1ec7c4f175f170870b2d2b0540c1
Instruction ID: c987d09447b3047efc258edff7faef4aef9fb275839215cf7de5ecbb2bae5786
Opcode Fuzzy Hash: 5237c7af1ecc08f42767a8041ab5e12976ab1ec7c4f175f170870b2d2b0540c1
Instruction Fuzzy Hash: 2CF0287254E3805FD30287146C560EABFF4DFC2231F18C6EBD8848A593D219191AC7E7

Uniqueness

Uniqueness Score: -1.00%

Function 02A2081E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693471269.0000000002A20000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a20000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1017b0457ee924f5862b1db6e58f2124e47abb03e3c81972d14ec885834464be
Instruction ID: eeb621d309bc7df93340fd10a228cd261b649f8914ca7146ee0bbbb10004155c
Opcode Fuzzy Hash: 1017b0457ee924f5862b1db6e58f2124e47abb03e3c81972d14ec885834464be
Instruction Fuzzy Hash: 1CF08CB28452046FD300DF15ED458A6F7ECEFD4A21F18C52EEC088B300E276AA148AE2

Uniqueness

Uniqueness Score: -1.00%

Function 02A2086F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693471269.0000000002A20000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a20000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2355fdbb97cf85a4f8d9c7cd092d1f975c744b035d857cdb91f816bb2cf6163b
Instruction ID: 3e444a7ac106c89daee03a18fd84b89b5125ec7d5804e383d51e11edb3d23113
Opcode Fuzzy Hash: 2355fdbb97cf85a4f8d9c7cd092d1f975c744b035d857cdb91f816bb2cf6163b
Instruction Fuzzy Hash: DDE092B6D491002BD2508A1978454A6B7C4E9A1130B64C17FDC898A302E1179D1A97A3

Uniqueness

Uniqueness Score: -1.00%

Function 02A00C50 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693460831.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3048cd87a453d9b37f75c20b6353d95b7f924c6cdc2c135714388d40077d662b
Instruction ID: f680b04c123a3c45124ddee1677138f9d53a28584a33ffdb2b8db092feb3ad6d
Opcode Fuzzy Hash: 3048cd87a453d9b37f75c20b6353d95b7f924c6cdc2c135714388d40077d662b
Instruction Fuzzy Hash: 0AE0D8B1F043182BC7449BB948811AE7FE5CBA2154F0148BAE148D7241EE368D42C380

Uniqueness

Uniqueness Score: -1.00%

Function 02A205F6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693471269.0000000002A20000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a20000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3a81435ea19133a332141533f0fb3d3122230f0bef712436c9b9e4258b67d0
Instruction ID: 45c3a83ea6d4cb92e6fb5996bd6fc16db3269eee0266933ae6fd124fe9947385
Opcode Fuzzy Hash: fa3a81435ea19133a332141533f0fb3d3122230f0bef712436c9b9e4258b67d0
Instruction Fuzzy Hash: D8E092766406004B9750CF0AEC45462F7E8EB88631718C07FDC0D8B700D675B544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02A00C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693460831.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1948ea56d83097dd78bfb0343612d15eb000db7fe82359ba00b24236f59fe0e5
Instruction ID: 98ab2a2bec939345316e90a62aa410580390e2cacad0817e5e1d4535430d4a08
Opcode Fuzzy Hash: 1948ea56d83097dd78bfb0343612d15eb000db7fe82359ba00b24236f59fe0e5
Instruction Fuzzy Hash: 64D01271F0421C5B8B48DAB9585655EBFEADB95554F104479B10CD7340EE319C4183C4

Uniqueness

Uniqueness Score: -1.00%

Function 02A00DD1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693460831.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a3972fa7c8f6072dbfb8d9075c9377018dbbbc152644604f06ec1dc4bbc210
Instruction ID: 42c39ebf9e16709d05de0503619e735d182d8eb6cac02081e2c97cdb426ceb5f
Opcode Fuzzy Hash: 86a3972fa7c8f6072dbfb8d9075c9377018dbbbc152644604f06ec1dc4bbc210
Instruction Fuzzy Hash: 0CE0C2705043804FC70BA334E498BA53FA26BE2304F4A85A6D1048B6A3E7388E42CB00

Uniqueness

Uniqueness Score: -1.00%

Function 010323F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693181031.0000000001032000.00000040.00000800.00020000.00000000.sdmp, Offset: 01032000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1032000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ccf3c97a6ca18ea6f778a89a3c535a5c08f5ba312cbb78b675a9f7ed0b74b3
Instruction ID: ce82f5171c3d6c39c50f32d0f2c2f76652e12ccf2a0849d04fb847e8d8b97bd9
Opcode Fuzzy Hash: 03ccf3c97a6ca18ea6f778a89a3c535a5c08f5ba312cbb78b675a9f7ed0b74b3
Instruction Fuzzy Hash: 1ED05E79205A824FE3268A1CD1A8F953BE9ABD1B04F4684FDE840CB763C768E5D1D200

Uniqueness

Uniqueness Score: -1.00%

Function 010323BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693181031.0000000001032000.00000040.00000800.00020000.00000000.sdmp, Offset: 01032000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1032000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937c619cfecfa781936077cfe2dd66615c17e29cb15b588a03c2fd2296485b
Instruction ID: 6052811a60fc706dbc7cc184b6def5e0f07d0a54b6aab119a9bdc5dae22ba8c8
Opcode Fuzzy Hash: f1937c619cfecfa781936077cfe2dd66615c17e29cb15b588a03c2fd2296485b
Instruction Fuzzy Hash: BED05E342412814BE715DB0CD1A8F597BD8AB81B04F0684EDAC408B262C3B4D881C640

Uniqueness

Uniqueness Score: -1.00%

Function 02A00E16 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693460831.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367b5fec7c74f2e4cbf568c5f95871a0e34f5b238742b3b5f5098cfca7e7f4ec
Instruction ID: a0cf40ad76393c89696b7f8bfbabf785f1a8215761bfbc60ab2270e76ce12fdd
Opcode Fuzzy Hash: 367b5fec7c74f2e4cbf568c5f95871a0e34f5b238742b3b5f5098cfca7e7f4ec
Instruction Fuzzy Hash: B1D012302103088BC704B768E5DDB25779767D5308F89C464A1082B391DF74EC42CA40

Uniqueness

Uniqueness Score: -1.00%

Function 02A00DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693460831.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a26aeb8ea03ff2808fb2aee7b542323c32e56ef38748973d4f5c6261331e086
Instruction ID: 380bcf9bb7b8f18c883f12899ac1aa6fff9372c103cffd2f8cbfd94874eb54bd
Opcode Fuzzy Hash: 1a26aeb8ea03ff2808fb2aee7b542323c32e56ef38748973d4f5c6261331e086
Instruction Fuzzy Hash: 23C002302502088BC708B768E599B2577D767D5708F45C56495095B395DF74EC41CA84

Uniqueness

Uniqueness Score: -1.00%

Function 02A00E18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.693460831.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52557d27c89fafc72723657beb9955e879ff9f0ed2fb4d9dfc54330139d39cf3
Instruction ID: 9a0b1265e475fe6a45b0e79a0b7e598ff7e62061be9b2630c7aa853926981b24
Opcode Fuzzy Hash: 52557d27c89fafc72723657beb9955e879ff9f0ed2fb4d9dfc54330139d39cf3
Instruction Fuzzy Hash: 3CC012302103088BC704B768E59DB25779667C5308F89C46461081B391DF74EC41CA40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Tactics:	Initial Access
Data Sources:	DNS records, Detonation chamber, Email gateway, Mail server, Packet capture, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Mar_02_Contract_12.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Qbot Downloader

Yara Signatures

Initial Sample

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0

Windows Analysis Report
Mar_02_Contract_12.pdf