Edit tour

Windows Analysis Report
37429345.pdf

Overview

General Information

Sample name:	37429345.pdf renamed because original name is a hash value
Original sample name:	_789337429345.pdf
Analysis ID:	1544035
MD5:	94391b5ded68319abaa7511b25e3661d
SHA1:	5b46961aa35ce1a8700c6db46132e1412a4aa23e
SHA256:	9f678c529e6a46f3cb2e5213932c5e235ac806ee064dd23336170e32ba29f5f9
Infos:

Detection

Score:	26
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Downloads suspicious files via Chrome

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 4080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\37429345.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6724 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5568 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2044 --field-trial-handle=1612,i,2609987279070104200,10577324592718449673,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7568 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://qaz.is/load/fK7NR3/668d3238-49f0-4207-9478-4e8005840fbb" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1896,i,12452905871821157740,5775890423641875054,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

unarchiver.exe (PID: 7572 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 7768 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\wu5ba1gq.lwu" "C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\LICENSE.txt

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: sets.json.10.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.10.dr	String found in binary or memory: https://24.hu
Source: sets.json.10.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.10.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.10.dr	String found in binary or memory: https://alice.tw
Source: sets.json.10.dr	String found in binary or memory: https://ambitionbox.com
Source: sets.json.10.dr	String found in binary or memory: https://autobild.de
Source: sets.json.10.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.10.dr	String found in binary or memory: https://bild.de
Source: sets.json.10.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.10.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.10.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.10.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.10.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.10.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.10.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.10.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.10.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.10.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.10.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.10.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.10.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.10.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.10.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.10.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.10.dr	String found in binary or memory: https://chennien.com
Source: sets.json.10.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.10.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.10.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.10.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.10.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.10.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.10.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.10.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.10.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.10.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.10.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.10.dr	String found in binary or memory: https://css-load.com
Source: sets.json.10.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.10.dr	String found in binary or memory: https://deere.com
Source: sets.json.10.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.10.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.10.dr	String found in binary or memory: https://drimer.io
Source: sets.json.10.dr	String found in binary or memory: https://drimer.travel
Source: sets.json.10.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.10.dr	String found in binary or memory: https://een.be
Source: sets.json.10.dr	String found in binary or memory: https://efront.com
Source: sets.json.10.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.10.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.10.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.10.dr	String found in binary or memory: https://ella.sv
Source: sets.json.10.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.10.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.10.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.10.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.10.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.10.dr	String found in binary or memory: https://finn.no
Source: sets.json.10.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.10.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.10.dr	String found in binary or memory: https://gettalkdesk.com
Source: sets.json.10.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.10.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.10.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://grid.id
Source: sets.json.10.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.10.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.10.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.10.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.10.dr	String found in binary or memory: https://hapara.com
Source: sets.json.10.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.10.dr	String found in binary or memory: https://hc1.com
Source: sets.json.10.dr	String found in binary or memory: https://hc1.global
Source: sets.json.10.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.10.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.10.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.10.dr	String found in binary or memory: https://hearty.app
Source: sets.json.10.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.10.dr	String found in binary or memory: https://hearty.me
Source: sets.json.10.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.10.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.10.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.10.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.10.dr	String found in binary or memory: https://hj.rs
Source: sets.json.10.dr	String found in binary or memory: https://hjck.com
Source: sets.json.10.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.10.dr	String found in binary or memory: https://html-load.com
Source: sets.json.10.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.10.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.10.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.10.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.10.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.10.dr	String found in binary or memory: https://img-load.com
Source: sets.json.10.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.10.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.10.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.10.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.10.dr	String found in binary or memory: https://interia.pl
Source: sets.json.10.dr	String found in binary or memory: https://intoday.in
Source: sets.json.10.dr	String found in binary or memory: https://iolam.it
Source: sets.json.10.dr	String found in binary or memory: https://ishares.com
Source: sets.json.10.dr	String found in binary or memory: https://jagran.com
Source: sets.json.10.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.10.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.10.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.10.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.10.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.10.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.10.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.10.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.10.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.10.dr	String found in binary or memory: https://kompas.com
Source: sets.json.10.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.10.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.10.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.10.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.10.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.10.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.10.dr	String found in binary or memory: https://libero.it
Source: sets.json.10.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.10.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.10.dr	String found in binary or memory: https://livechat.com
Source: sets.json.10.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.10.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.10.dr	String found in binary or memory: https://livemint.com
Source: sets.json.10.dr	String found in binary or memory: https://max.auto
Source: sets.json.10.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.10.dr	String found in binary or memory: https://meo.pt
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.10.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.10.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.10.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.10.dr	String found in binary or memory: https://money.pl
Source: sets.json.10.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.10.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.10.dr	String found in binary or memory: https://nacion.com
Source: sets.json.10.dr	String found in binary or memory: https://naukri.com
Source: sets.json.10.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.10.dr	String found in binary or memory: https://nien.co
Source: sets.json.10.dr	String found in binary or memory: https://nien.com
Source: sets.json.10.dr	String found in binary or memory: https://nien.org
Source: sets.json.10.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.10.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.10.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.10.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.10.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.10.dr	String found in binary or memory: https://o2.pl
Source: sets.json.10.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.10.dr	String found in binary or memory: https://onet.pl
Source: sets.json.10.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.10.dr	String found in binary or memory: https://p106.net
Source: sets.json.10.dr	String found in binary or memory: https://p24.hu
Source: sets.json.10.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.10.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.10.dr	String found in binary or memory: https://player.pl
Source: sets.json.10.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.10.dr	String found in binary or memory: https://poalim.site
Source: sets.json.10.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.10.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.10.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.10.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.10.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.10.dr	String found in binary or memory: https://punjabijagran.com
Source: 37429345.pdf	String found in binary or memory: https://qaz.is/load/fK7NR3/668d3238-49f0-4207-9478-4e8005840fbb)
Source: sets.json.10.dr	String found in binary or memory: https://radio1.be
Source: sets.json.10.dr	String found in binary or memory: https://radio2.be
Source: sets.json.10.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.10.dr	String found in binary or memory: https://repid.org
Source: sets.json.10.dr	String found in binary or memory: https://reshim.org
Source: sets.json.10.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.10.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.10.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.10.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.10.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.10.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.10.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.10.dr	String found in binary or memory: https://samayam.com
Source: sets.json.10.dr	String found in binary or memory: https://sapo.io
Source: sets.json.10.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.10.dr	String found in binary or memory: https://shock.co
Source: sets.json.10.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.10.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.10.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.10.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.10.dr	String found in binary or memory: https://songshare.com
Source: sets.json.10.dr	String found in binary or memory: https://songstats.com
Source: sets.json.10.dr	String found in binary or memory: https://sporza.be
Source: sets.json.10.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.10.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.10.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.10.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.10.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.10.dr	String found in binary or memory: https://stripe.com
Source: sets.json.10.dr	String found in binary or memory: https://stripe.network
Source: sets.json.10.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.10.dr	String found in binary or memory: https://supereva.it
Source: sets.json.10.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.10.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.10.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.10.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.10.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.10.dr	String found in binary or memory: https://text.com
Source: sets.json.10.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.10.dr	String found in binary or memory: https://the42.ie
Source: sets.json.10.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.10.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.10.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.10.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.10.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.10.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.10.dr	String found in binary or memory: https://top.pl
Source: sets.json.10.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.10.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.10.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.10.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.10.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.10.dr	String found in binary or memory: https://tvid.in
Source: sets.json.10.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.10.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.10.dr	String found in binary or memory: https://unotv.com
Source: sets.json.10.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.10.dr	String found in binary or memory: https://vrt.be
Source: sets.json.10.dr	String found in binary or memory: https://vwo.com
Source: sets.json.10.dr	String found in binary or memory: https://welt.de
Source: sets.json.10.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.10.dr	String found in binary or memory: https://wildix.com
Source: sets.json.10.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.10.dr	String found in binary or memory: https://wingify.com
Source: sets.json.10.dr	String found in binary or memory: https://wordle.at
Source: sets.json.10.dr	String found in binary or memory: https://wp.pl
Source: sets.json.10.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.10.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.10.dr	String found in binary or memory: https://ya.ru
Source: sets.json.10.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://zalo.me
Source: sets.json.10.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.10.dr	String found in binary or memory: https://zingmp3.vn

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar (copy)

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\Google.Widevine.CDM.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1314818920	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1314818920\cr_en-us_500000_index.bin	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1314818920\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1314818920\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1314818920\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1314818920\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\LICENSE.txt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\Filtering Rules	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1677436516	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1677436516\optimization-hints.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1677436516\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1677436516\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1677436516\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1677436516\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_7568_706173810

Jump to behavior

Source: Google.Widevine.CDM.dll.10.dr

Static PE information: Number of sections : 12 > 10

Source: unarchiver.exe, 0000000F.00000002.1960912103.00000000010CE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBp

Source: classification engine

Classification label: sus26.winPDF@45/68@0/5

Source: 37429345.pdf	Initial sample: https://qaz.is/load/fK7NR3/668d3238-49f0-4207-9478-4e8005840fbb
Source: 37429345.pdf	Initial sample: https://qaz.is/load/fk7nr3/668d3238-49f0-4207-9478-4e8005840fbb

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-28 13-29-01-083.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\37429345.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2044 --field-trial-handle=1612,i,2609987279070104200,10577324592718449673,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://qaz.is/load/fK7NR3/668d3238-49f0-4207-9478-4e8005840fbb"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1896,i,12452905871821157740,5775890423641875054,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\wu5ba1gq.lwu" "C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2044 --field-trial-handle=1612,i,2609987279070104200,10577324592718449673,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://qaz.is/load/fK7NR3/668d3238-49f0-4207-9478-4e8005840fbb"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1896,i,12452905871821157740,5775890423641875054,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\wu5ba1gq.lwu" "C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar"	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior

Source: Google Drive.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: 37429345.pdf	Initial sample: PDF keyword /JS count = 0
Source: 37429345.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 37429345.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Google.Widevine.CDM.dll.10.dr	Static PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.10.dr	Static PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.10.dr	Static PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.10.dr	Static PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.10.dr	Static PE information: section name: _RDATA

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\LICENSE.txt

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 1090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 2F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 4F40000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7900

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 15_2_00EBB1D6 GetSystemInfo,

15_2_00EBB1D6

Source: C:\Windows\SysWOW64\unarchiver.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\wu5ba1gq.lwu" "C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar"

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	21 Masquerading	OS Credential Dumping	31 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	3 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
37429345.pdf	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\Google.Widevine.CDM.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://wieistmeineip.de	0%	URL Reputation	safe
https://mercadoshops.com.co	0%	URL Reputation	safe
https://gliadomain.com	0%	URL Reputation	safe
https://poalim.xyz	0%	URL Reputation	safe
https://mercadolivre.com	0%	URL Reputation	safe
https://reshim.org	0%	URL Reputation	safe
https://nourishingpursuits.com	0%	URL Reputation	safe
https://medonet.pl	0%	URL Reputation	safe
https://unotv.com	0%	URL Reputation	safe
https://mercadoshops.com.br	0%	URL Reputation	safe
https://zdrowietvn.pl	0%	URL Reputation	safe
https://johndeere.com	0%	URL Reputation	safe
https://songstats.com	0%	URL Reputation	safe
https://baomoi.com	0%	URL Reputation	safe
https://supereva.it	0%	URL Reputation	safe
https://elfinancierocr.com	0%	URL Reputation	safe
https://bolasport.com	0%	URL Reputation	safe
https://rws1nvtvt.com	0%	URL Reputation	safe
https://desimartini.com	0%	URL Reputation	safe
https://hearty.app	0%	URL Reputation	safe
https://hearty.gift	0%	URL Reputation	safe
https://mercadoshops.com	0%	URL Reputation	safe
https://heartymail.com	0%	URL Reputation	safe
https://p106.net	0%	URL Reputation	safe
https://radio2.be	0%	URL Reputation	safe
https://finn.no	0%	URL Reputation	safe
https://hc1.com	0%	URL Reputation	safe
https://kompas.tv	0%	URL Reputation	safe
https://mystudentdashboard.com	0%	URL Reputation	safe
https://songshare.com	0%	URL Reputation	safe
https://mercadopago.com.mx	0%	URL Reputation	safe
https://p24.hu	0%	URL Reputation	safe
https://talkdeskqaid.com	0%	URL Reputation	safe
https://mercadopago.com.pe	0%	URL Reputation	safe
https://cardsayings.net	0%	URL Reputation	safe
https://mightytext.net	0%	URL Reputation	safe
https://pudelek.pl	0%	URL Reputation	safe
https://hazipatika.com	0%	URL Reputation	safe
https://joyreactor.com	0%	URL Reputation	safe
https://cookreactor.com	0%	URL Reputation	safe
https://wildixin.com	0%	URL Reputation	safe
https://eworkbookcloud.com	0%	URL Reputation	safe
https://cognitiveai.ru	0%	URL Reputation	safe
https://nacion.com	0%	URL Reputation	safe
https://chennien.com	0%	URL Reputation	safe
https://drimer.travel	0%	URL Reputation	safe
https://mercadopago.cl	0%	URL Reputation	safe
https://talkdeskstgid.com	0%	URL Reputation	safe
https://bonvivir.com	0%	URL Reputation	safe
https://carcostadvisor.be	0%	URL Reputation	safe
https://salemovetravel.com	0%	URL Reputation	safe
https://sapo.io	0%	URL Reputation	safe
https://wpext.pl	0%	URL Reputation	safe
https://welt.de	0%	URL Reputation	safe
https://poalim.site	0%	URL Reputation	safe
https://drimer.io	0%	URL Reputation	safe
https://infoedgeindia.com	0%	URL Reputation	safe
https://blackrockadvisorelite.it	0%	URL Reputation	safe
https://cognitive-ai.ru	0%	URL Reputation	safe
https://cafemedia.com	0%	URL Reputation	safe
https://graziadaily.co.uk	0%	URL Reputation	safe
https://thirdspace.org.au	0%	URL Reputation	safe
https://mercadoshops.com.ar	0%	URL Reputation	safe
https://smpn106jkt.sch.id	0%	URL Reputation	safe
https://elpais.uy	0%	URL Reputation	safe
https://landyrev.com	0%	URL Reputation	safe
https://commentcamarche.com	0%	URL Reputation	safe
https://tucarro.com.ve	0%	URL Reputation	safe
https://rws3nvtvt.com	0%	URL Reputation	safe
https://eleconomista.net	0%	URL Reputation	safe
https://mercadolivre.com.br	0%	URL Reputation	safe
https://clmbtech.com	0%	URL Reputation	safe
https://standardsandpraiserepurpose.com	0%	URL Reputation	safe
https://salemovefinancial.com	0%	URL Reputation	safe
https://mercadopago.com.br	0%	URL Reputation	safe
https://commentcamarche.net	0%	URL Reputation	safe
https://etfacademy.it	0%	URL Reputation	safe
https://mighty-app.appspot.com	0%	URL Reputation	safe
https://hj.rs	0%	URL Reputation	safe
https://hearty.me	0%	URL Reputation	safe
https://mercadolibre.com.gt	0%	URL Reputation	safe
https://timesinternet.in	0%	URL Reputation	safe
https://indiatodayne.in	0%	URL Reputation	safe
https://idbs-staging.com	0%	URL Reputation	safe
https://blackrock.com	0%	URL Reputation	safe
https://idbs-eworkbook.com	0%	URL Reputation	safe
https://motherandbaby.com	0%	URL Reputation	safe
https://mercadolibre.co.cr	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://wieistmeineip.de	sets.json.10.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.co	sets.json.10.dr	false	URL Reputation: safe	unknown
https://gliadomain.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://poalim.xyz	sets.json.10.dr	false	URL Reputation: safe	unknown
https://mercadolivre.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://reshim.org	sets.json.10.dr	false	URL Reputation: safe	unknown
https://nourishingpursuits.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://medonet.pl	sets.json.10.dr	false	URL Reputation: safe	unknown
https://unotv.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.br	sets.json.10.dr	false	URL Reputation: safe	unknown
https://joyreactor.cc	sets.json.10.dr	false		unknown
https://zdrowietvn.pl	sets.json.10.dr	false	URL Reputation: safe	unknown
https://johndeere.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://songstats.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://baomoi.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://supereva.it	sets.json.10.dr	false	URL Reputation: safe	unknown
https://elfinancierocr.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://bolasport.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://rws1nvtvt.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://desimartini.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://hearty.app	sets.json.10.dr	false	URL Reputation: safe	unknown
https://hearty.gift	sets.json.10.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://heartymail.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://nlc.hu	sets.json.10.dr	false		unknown
https://p106.net	sets.json.10.dr	false	URL Reputation: safe	unknown
https://radio2.be	sets.json.10.dr	false	URL Reputation: safe	unknown
https://finn.no	sets.json.10.dr	false	URL Reputation: safe	unknown
https://hc1.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://kompas.tv	sets.json.10.dr	false	URL Reputation: safe	unknown
https://mystudentdashboard.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://songshare.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://smaker.pl	sets.json.10.dr	false		unknown
https://mercadopago.com.mx	sets.json.10.dr	false	URL Reputation: safe	unknown
https://p24.hu	sets.json.10.dr	false	URL Reputation: safe	unknown
https://talkdeskqaid.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://24.hu	sets.json.10.dr	false		unknown
https://mercadopago.com.pe	sets.json.10.dr	false	URL Reputation: safe	unknown
https://cardsayings.net	sets.json.10.dr	false	URL Reputation: safe	unknown
https://text.com	sets.json.10.dr	false		unknown
https://mightytext.net	sets.json.10.dr	false	URL Reputation: safe	unknown
https://pudelek.pl	sets.json.10.dr	false	URL Reputation: safe	unknown
https://hazipatika.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://joyreactor.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://cookreactor.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://wildixin.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://eworkbookcloud.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://cognitiveai.ru	sets.json.10.dr	false	URL Reputation: safe	unknown
https://nacion.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://chennien.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://drimer.travel	sets.json.10.dr	false	URL Reputation: safe	unknown
https://deccoria.pl	sets.json.10.dr	false		unknown
https://mercadopago.cl	sets.json.10.dr	false	URL Reputation: safe	unknown
https://talkdeskstgid.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://naukri.com	sets.json.10.dr	false		unknown
https://interia.pl	sets.json.10.dr	false		unknown
https://bonvivir.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://carcostadvisor.be	sets.json.10.dr	false	URL Reputation: safe	unknown
https://salemovetravel.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://sapo.io	sets.json.10.dr	false	URL Reputation: safe	unknown
https://wpext.pl	sets.json.10.dr	false	URL Reputation: safe	unknown
https://welt.de	sets.json.10.dr	false	URL Reputation: safe	unknown
https://poalim.site	sets.json.10.dr	false	URL Reputation: safe	unknown
https://drimer.io	sets.json.10.dr	false	URL Reputation: safe	unknown
https://infoedgeindia.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://blackrockadvisorelite.it	sets.json.10.dr	false	URL Reputation: safe	unknown
https://cognitive-ai.ru	sets.json.10.dr	false	URL Reputation: safe	unknown
https://cafemedia.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://graziadaily.co.uk	sets.json.10.dr	false	URL Reputation: safe	unknown
https://thirdspace.org.au	sets.json.10.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.ar	sets.json.10.dr	false	URL Reputation: safe	unknown
https://smpn106jkt.sch.id	sets.json.10.dr	false	URL Reputation: safe	unknown
https://elpais.uy	sets.json.10.dr	false	URL Reputation: safe	unknown
https://landyrev.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://the42.ie	sets.json.10.dr	false		unknown
https://commentcamarche.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://tucarro.com.ve	sets.json.10.dr	false	URL Reputation: safe	unknown
https://rws3nvtvt.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://eleconomista.net	sets.json.10.dr	false	URL Reputation: safe	unknown
https://helpdesk.com	sets.json.10.dr	false		unknown
https://mercadolivre.com.br	sets.json.10.dr	false	URL Reputation: safe	unknown
https://clmbtech.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://standardsandpraiserepurpose.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://07c225f3.online	sets.json.10.dr	false		unknown
https://salemovefinancial.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.br	sets.json.10.dr	false	URL Reputation: safe	unknown
https://qaz.is/load/fK7NR3/668d3238-49f0-4207-9478-4e8005840fbb)	37429345.pdf	false		unknown
https://commentcamarche.net	sets.json.10.dr	false	URL Reputation: safe	unknown
https://etfacademy.it	sets.json.10.dr	false	URL Reputation: safe	unknown
https://mighty-app.appspot.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://hj.rs	sets.json.10.dr	false	URL Reputation: safe	unknown
https://hearty.me	sets.json.10.dr	false	URL Reputation: safe	unknown
https://mercadolibre.com.gt	sets.json.10.dr	false	URL Reputation: safe	unknown
https://timesinternet.in	sets.json.10.dr	false	URL Reputation: safe	unknown
https://indiatodayne.in	sets.json.10.dr	false	URL Reputation: safe	unknown
https://idbs-staging.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://blackrock.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://idbs-eworkbook.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://motherandbaby.com	sets.json.10.dr	false	URL Reputation: safe	unknown
https://mercadolibre.co.cr	sets.json.10.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.185.100	unknown	United States	15169	GOOGLEUS	false
80.87.203.251	unknown	Russian Federation	29182	THEFIRST-ASRU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544035
Start date and time:	2024-10-28 18:27:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	37429345.pdf renamed because original name is a hash value
Original Sample Name:	_789337429345.pdf
Detection:	SUS
Classification:	sus26.winPDF@45/68@0/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 43 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.193.227.236, 18.207.85.246, 54.144.73.197, 107.22.247.231, 162.159.61.3, 172.64.41.3, 93.184.221.240, 2.23.197.184, 88.221.168.141, 2.19.126.149, 2.19.126.143, 23.218.232.159, 23.218.232.146, 192.168.2.8, 142.250.186.67, 142.250.186.78, 173.194.76.84, 34.104.35.123, 192.229.221.95, 172.217.16.202, 172.217.16.138, 142.250.186.170, 172.217.23.106, 216.58.206.74, 142.250.184.202, 142.250.186.74, 142.250.184.234, 142.250.186.42, 172.217.18.106, 172.217.18.10, 142.250.74.202, 142.250.185.74, 142.250.181.234, 142.250.186.138, 142.250.186.106, 142.250.184.227, 172.217.18.110, 142.250.186.163
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, clientservices.googleapis.com, wu.azureedge.net, acroipm2.adobe.com, dns.msftncsi.com, clients2.google.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, optimizationguide-pa.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, edgedl.me.gvt1.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 37429345.pdf

Simulations

Behavior and APIs

Time	Type	Description
13:29:12	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1.1.1.1	PO-230821_pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
	AFfv8HpACF.exe	Get hash	malicious	Unknown	Browse	1.1.1.1/
	INVOICE_90990_PDF.exe	Get hash	malicious	FormBook	Browse	www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
	Go.exe	Get hash	malicious	Unknown	Browse	1.1.1.1/
239.255.255.250	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse
	https://1drv.ms/o/s!BOd5RNxFaxkGg1r5bc30bgQWmkNc?e=J67qxK-KfEurqpMk0dasTw&at=9	Get hash	malicious	Unknown	Browse
	https://docs.google.com/drawings/d/1O7L6jnunpKYYRy1ZXX5DN4ENeZ4pxxWF8BG0mcDdFi0/preview?pli=1ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVe	Get hash	malicious	HTMLPhisher	Browse
	renier_visser-In Employee -11384.pdf	Get hash	malicious	Unknown	Browse
	https://www-suasconsult-com-br.translate.goog/?_x_tr_sl=pt&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc	Get hash	malicious	Unknown	Browse
	http://demettei.com	Get hash	malicious	Unknown	Browse
	http://doscome.cluster029.hosting.ovh.net/Sglient/	Get hash	malicious	Unknown	Browse
	https://edpage.suasconsult.com.br/Bin/support.Client.exe?h=looj.xsmqcreoarta-010.de&p=5837&k=BgIAAACkAABSU0ExAAgAAAEAAQBVXsSEc%2Bx9uXD3C%2F7hA6k%2BCkYq8qNt9ddXTDuk6xtcDXcigKgagdDrv%2FcdVObs%2B5PsIEqa3J7G2KVNlw%2FruJmp5gWKLUA7CGK0M2xYP%2FnHrh8PGKb6APgX8%2BMmK%2FRI%2FuG1ObyHzrZSA2zDxqMWtbhBTbrYOR9GzyZRtT2sHBbUlx41DAcKHlRcqgqrm7UWwNY1mXMg1RfS2uCkTVjdU3GL7AKxo9LZAF%2BNZ31xMPej0IfTdjxJIuBFFPQhiLUl3MrrnM%2BcDzOJ4R5qzkEDJux1InHPO4447uQgY2C%2FpH9XXbyUJCVvgFFCPS5LSQJiQ7CvgPW3fKiAsEahrr56vu2y&s=91e7c5ac-5da8-42d0-b490-659f144c6095&i=Untitled%20Session&e=Support&y=Guest&r=	Get hash	malicious	ScreenConnect Tool	Browse
	https://docs.google.com/drawings/d/1JRNFh_1Cbzym_iLfw5aw8-eo7G0EKRf1L0-MpuWvb2k/preview?pli=1MiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqG	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	104.18.11.207
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://docs.google.com/drawings/d/1O7L6jnunpKYYRy1ZXX5DN4ENeZ4pxxWF8BG0mcDdFi0/preview?pli=1ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVe	Get hash	malicious	HTMLPhisher	Browse	104.21.49.204
	renier_visser-In Employee -11384.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www-suasconsult-com-br.translate.goog/?_x_tr_sl=pt&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc	Get hash	malicious	Unknown	Browse	188.114.96.3
	z74fBF2ObiS1g87mbS.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	http://shoutout.wix.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	Scan_1626227.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!sb98dbf79ab614921877689e4912e2fae&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VubV9qYmxocXlGSmgzYUo1SkV1TDY0QmtKQzA5SEFwTjV6cTh1YW5PSWxxNEE_ZT1pdGFpeGo&wd=target%28Sezione%20senza%20titolo.one%7Ccfe57f3b-5d7b-4d15-b045-f6fdb53b3776%2FRechnung%2039920898-43006843%20%5C%7C%20Ebner%20Media%20Group%7C205becae-dae9-4a36-907a-485bcab69387%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	104.21.79.135
THEFIRST-ASRU	auXl1Tzyme.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	37.46.131.145
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	79.174.13.9
	spc.elf	Get hash	malicious	Unknown	Browse	37.230.119.195
	J8AqA3S6gY.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	82.146.53.9
	SecuriteInfo.com.W32.HackTool_GameHack.FN.tr.21595.30956.exe	Get hash	malicious	Unknown	Browse	82.202.167.133
	fBcMVl6ns6.lnk	Get hash	malicious	RHADAMANTHYS	Browse	80.87.193.193
	rpQF1aDIK4.lnk	Get hash	malicious	RHADAMANTHYS	Browse	80.87.193.193
	test.ps1	Get hash	malicious	RHADAMANTHYS	Browse	80.87.193.193
	path.ps1	Get hash	malicious	DcRat	Browse	80.87.193.193
	mEudzoO1bG.exe	Get hash	malicious	FormBook	Browse	62.109.1.5

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\Google.Widevine.CDM.dll	_Play__New__VM__01min 04sec____ATT2006587654 (Randiwestbrook) .htm	Get hash	malicious	HTMLPhisher	Browse
	attachment(1).eml	Get hash	malicious	Unknown	Browse
	sample.pdf	Get hash	malicious	HtmlDropper	Browse
	Technical_Technical_Specifications_&_Data_for_Optimized_Process.html	Get hash	malicious	HTMLPhisher	Browse
	phishtest.html	Get hash	malicious	Unknown	Browse
	DRL-272112.htm	Get hash	malicious	Unknown	Browse
	ATT037484_Msg#189815.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	Project_Proposal_Review_and_Approval13617.pdf	Get hash	malicious	Unknown	Browse
	ordine.pdf	Get hash	malicious	HtmlDropper	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.16449.26967.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.247691192614138
Encrypted:	false
SSDEEP:	6:yaRL+q2PCHhJ2nKuAl9OmbnIFUt8haU11Zmw+haUjLVkwOCHhJ2nKuAl9OmbjLJ:fL+vBHAahFUt89/+pLV56HAaSJ
MD5:	228F89E80C3A6E7A46EC814260D9818C
SHA1:	3D504AC491C39DA8C9D6725B76DF3D8D4798417E
SHA-256:	A3AB80792DB0C08D352E700D54770B26BEC2CAD99161D27F56265997658A1471
SHA-512:	D1DA5DE638671BFD2A28D38E8791425C64040A9A276B731FEA59D6DEED74517020AC3AA664E490EB1E906D904EF0062E11666355D35E007438878EF68ADFF332
Malicious:	false
Reputation:	low
Preview:	2024/10/28-13:28:59.413 117c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/28-13:28:59.418 117c Recovering log #3.2024/10/28-13:28:59.418 117c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.247691192614138
Encrypted:	false
SSDEEP:	6:yaRL+q2PCHhJ2nKuAl9OmbnIFUt8haU11Zmw+haUjLVkwOCHhJ2nKuAl9OmbjLJ:fL+vBHAahFUt89/+pLV56HAaSJ
MD5:	228F89E80C3A6E7A46EC814260D9818C
SHA1:	3D504AC491C39DA8C9D6725B76DF3D8D4798417E
SHA-256:	A3AB80792DB0C08D352E700D54770B26BEC2CAD99161D27F56265997658A1471
SHA-512:	D1DA5DE638671BFD2A28D38E8791425C64040A9A276B731FEA59D6DEED74517020AC3AA664E490EB1E906D904EF0062E11666355D35E007438878EF68ADFF332
Malicious:	false
Reputation:	low
Preview:	2024/10/28-13:28:59.413 117c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/28-13:28:59.418 117c Recovering log #3.2024/10/28-13:28:59.418 117c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.20202348660923
Encrypted:	false
SSDEEP:	6:yadu+q2PCHhJ2nKuAl9Ombzo2jMGIFUt8hC5Zmw+hINVkwOCHhJ2nKuAl9Ombzos:zfvBHAa8uFUt80/+2z56HAa8RJ
MD5:	C7B008DB2DC203E100EDF1BEF53D1C7A
SHA1:	C9885CD1176ABEC7CC2977EDC434544E315CB735
SHA-256:	A912B4CF7A1134B76E33770A397781327EEE878963C3AEBCF58FBDBCED5CD0C6
SHA-512:	27BAE251B5C673449CC88539DDAFE21755FD2ABE56C2A1A181E2D7210E8B6ED74DD08565D8EA2952B045B9500CFE50F2F38694F9CAA4DB669D774CB338CBD290
Malicious:	false
Preview:	2024/10/28-13:28:59.489 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/28-13:28:59.529 1c28 Recovering log #3.2024/10/28-13:28:59.530 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.20202348660923
Encrypted:	false
SSDEEP:	6:yadu+q2PCHhJ2nKuAl9Ombzo2jMGIFUt8hC5Zmw+hINVkwOCHhJ2nKuAl9Ombzos:zfvBHAa8uFUt80/+2z56HAa8RJ
MD5:	C7B008DB2DC203E100EDF1BEF53D1C7A
SHA1:	C9885CD1176ABEC7CC2977EDC434544E315CB735
SHA-256:	A912B4CF7A1134B76E33770A397781327EEE878963C3AEBCF58FBDBCED5CD0C6
SHA-512:	27BAE251B5C673449CC88539DDAFE21755FD2ABE56C2A1A181E2D7210E8B6ED74DD08565D8EA2952B045B9500CFE50F2F38694F9CAA4DB669D774CB338CBD290
Malicious:	false
Preview:	2024/10/28-13:28:59.489 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/28-13:28:59.529 1c28 Recovering log #3.2024/10/28-13:28:59.530 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7949dccb-9dc0-46ce-9bb1-e825e679125d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.96406374654267
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq90SsBdOg2Htcaq3QYiub6P7E4T3y:Y2sRdsVXdMHc3QYhbS7nby
MD5:	61CD2D3CF2F532BD7AE0711E3CDB3C0C
SHA1:	A5A0FCD975A421A4EFC4D59EBBA2F959E74A6BED
SHA-256:	A9526B2B88F9C96E0979F7F1E6D7F26E25C37B3FEDC73A606CEC0CF396117467
SHA-512:	CD0E5E5E63804D014DEEBCD9481CE3817EBCB2E9262D42541A905788EBF39EF7F5ABC50E6BFCAAE8A08D7E971F92B8E32A7ACCF15144AC0E01EC6CB871F72D40
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374696545586375","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":241624},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96406374654267
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq90SsBdOg2Htcaq3QYiub6P7E4T3y:Y2sRdsVXdMHc3QYhbS7nby
MD5:	61CD2D3CF2F532BD7AE0711E3CDB3C0C
SHA1:	A5A0FCD975A421A4EFC4D59EBBA2F959E74A6BED
SHA-256:	A9526B2B88F9C96E0979F7F1E6D7F26E25C37B3FEDC73A606CEC0CF396117467
SHA-512:	CD0E5E5E63804D014DEEBCD9481CE3817EBCB2E9262D42541A905788EBF39EF7F5ABC50E6BFCAAE8A08D7E971F92B8E32A7ACCF15144AC0E01EC6CB871F72D40
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374696545586375","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":241624},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4288
Entropy (8bit):	5.228307084705755
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bYXXnloqGXPG6oZ:S43C4mS7fFi0KFYDjr3LWO3V3aw+bYXP
MD5:	BC5F7850944A1A9F8E63FAE9D4251E0C
SHA1:	9A00275D42298833AD51379911E2527A0B5AD951
SHA-256:	51D38A74B03CAEA9C8772A41061365B7243C6DE6F49F442368B2E3DE3B46A184
SHA-512:	FF0B67B9A116D0AC32F979B9A6043461CE216BA659772517A66ABAD0F170BD4C7FABA37DB67587802C737766FB321B2BCEB9D2C0D9D6E1AC7DBCDB773E7637D1
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.208224262754266
Encrypted:	false
SSDEEP:	6:yy1+q2PCHhJ2nKuAl9OmbzNMxIFUt8hQZZmw+hoN3VkwOCHhJ2nKuAl9OmbzNMFd:QvBHAa8jFUt8+Z/+8F56HAa84J
MD5:	7A26DEE223C984846F7586BF66215121
SHA1:	D6E2DAE17554979EA546F29FB68E97AFA3E25D9D
SHA-256:	2EE5B113EF956A0321CCB3913F8CF86207E632D4E5C50AAA6E5DE3D0F52C2964
SHA-512:	53FE790281232ED78E89B238201F374F85AE39B05254BBE3CAAB849A091DDAB06DE153C36E4FAEC753AC6620B3FF415CDD5E7BB62E48C463C250A13DF043656B
Malicious:	false
Preview:	2024/10/28-13:28:59.909 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/28-13:28:59.912 1c28 Recovering log #3.2024/10/28-13:28:59.914 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.208224262754266
Encrypted:	false
SSDEEP:	6:yy1+q2PCHhJ2nKuAl9OmbzNMxIFUt8hQZZmw+hoN3VkwOCHhJ2nKuAl9OmbzNMFd:QvBHAa8jFUt8+Z/+8F56HAa84J
MD5:	7A26DEE223C984846F7586BF66215121
SHA1:	D6E2DAE17554979EA546F29FB68E97AFA3E25D9D
SHA-256:	2EE5B113EF956A0321CCB3913F8CF86207E632D4E5C50AAA6E5DE3D0F52C2964
SHA-512:	53FE790281232ED78E89B238201F374F85AE39B05254BBE3CAAB849A091DDAB06DE153C36E4FAEC753AC6620B3FF415CDD5E7BB62E48C463C250A13DF043656B
Malicious:	false
Preview:	2024/10/28-13:28:59.909 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/28-13:28:59.912 1c28 Recovering log #3.2024/10/28-13:28:59.914 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241028172903Z-177.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	1.2769780725047335
Encrypted:	false
SSDEEP:	96:miakqCzjOkJWR67MinlNHQ7uKLo/kot/tTBXGdOKlbcMaRJaNHuwGTUIDh3/KMHW:7ooVlVIy9drisJMk1gRYNooSf
MD5:	B0AD94BA4858E9C35115D01D9D3E885B
SHA1:	E36592A4F7BE7BEB21FC09EECEDFCA26A867470B
SHA-256:	BC0AB4503C3FF4328A2FBDB8E401C6FCACA8ED1E306D016F2549B49A3C5E74A3
SHA-512:	9539ACA624A65DA527CC8F6DEE89D238E9C0A81859EC2B17DE624A730F123AD07A2EF1C9C51A44D27BD76789EAEC2FD023CF547FE1D4B00542195E20EE3B9915
Malicious:	false
Preview:	BM........6...(...u...h..... .............................................................................pF..pF..pF..qF..rF..rF..rF..rF..rG..rG..tG..uI..uI..tH..tH..uG..vH..wI..wI..wI..wI..wI..wI..wJ..xJ..zJ..zJ..zJ..zJ..yI..yJ..{J..{J..{J..\|K..\|K..\|K..\|K..\|K..\|K..\|K..\|K..}K..~K..~K..~K..}K..\|L..\|L..\|K..\|K..\|K..\|K..\|K..\|K..\|K..{J..{J..{J..yI..yI..zJ..zJ..zJ..yJ..wJ..wI..wI..wI..wI..wI..wI..wH..vG..vG..tH..tH..uI..uI..uH..uH..sG..rG..rF..rF..rF..rF..rF..pF..pF..pF..........................................................................................................pF..pF..pF..qF..rF..rF..rF..rF..rG..sG..uH..uI..uI..tH..uG..vG..vH..wI..wI..wI..wI..wI..wI..wJ..xJ..zJ..zJ..yI..yI..yJ..{J..{J..\|K..\|K..\|K..\|K..\|K..\|K..\|K..}K..}K..}K..}K..~K..~K..~K..}K..}K..}K..}K..\|K..\|K..\|K..\|K..\|K..\|K..\|K..\|K..{J..{J..yI..yI..zJ..zJ..yJ..yJ..wJ..wI..wI..wI..wI..wI..wH..vH..vG..vG..vG..tH..uI..uH..uH..sG..rG..rF..rF..rF..rF..rF..pF..pF..pF................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 4, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.2936194223029633
Encrypted:	false
SSDEEP:	192:PedRBxVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:Penci5H5FY+EUUUTTcHqFzqFP
MD5:	A1156F9B0553E7FA1FF2763ED4D8BBE6
SHA1:	164794FDCBC98249CF5CB967DF99004887D12D63
SHA-256:	23892F868CDAEAC8AAFCEF198D7EC3D747F4902B811D70341B54B43F10362345
SHA-512:	160DAFBE01000AA2A8CB243A1ECE5D235DAD39083B6C6E78DE964E8BF030C88442F37960284A9ECEDDCDB28BA9ACA6431027989DC3438AF1E46F3665AA6510DC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2135900050785247
Encrypted:	false
SSDEEP:	24:7+tsWDawKgqLKzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mq:7M8gqOmFTIF3XmHjBoGGR+jMz+Lhr
MD5:	846BFE18773AF54F40DAB76A6F9F69AE
SHA1:	5CEC8BBB476A3D8ECC0752F77FDE29AF144964ED
SHA-256:	66A63DB2902BF65EA64DEEED20B74E9275C64764DE844D8EBE2A0D6526236476
SHA-512:	B2AE336F4EE655938EDA2D7687F40AB64537FEF0DA4B7F6A7FF5E40DC7459AD73DEA6043902A4053180DDA903F8BED9E20F94F51194C75FAD0A804757633B23E
Malicious:	false
Preview:	.... .c.......\|.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFkl6nlzttfllXlE/HT8k9whlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKjnFteT80wzdNMa8RdWBwRd
MD5:	B3E38BA05E71184E25ADCE551B57763A
SHA1:	EEE6FE30B5863894B2F0DB2DC3932852EBDF7776
SHA-256:	9329114D34F94F98A0AA4F7A3D9ACAE7EB5332EDF42994F818B3242816E314CC
SHA-512:	CD40190B3CC63F0E3BD204AF08B53BB1D2BF428F1C6B71715C38AC5CA5E05CA64C33DBA9B924C8CD4F04D093760C30BB3907B30FC7FDACFF635F94595272129A
Malicious:	false
Preview:	p...... .........@.^)..(....................................................... ..........W.....U..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.150184159866505
Encrypted:	false
SSDEEP:	6:kKPK/EtL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:HK/EtiDnLNkPlE99SNxAhUe/3
MD5:	287ABAB739214533BC7358767AFF7D39
SHA1:	EC3031A1648A7E4A1E149A4D5CFF94320E0863D3
SHA-256:	6242B86080A80A4A1D278D7F6A0A90B26EEF21EADCC3D60B317898511B29D53A
SHA-512:	909FD62514E4AEAFCA60FB11B7CD351C5C5C1F9F26E915047FD526BB1C5FA5C566C4F0A0E45F9F7060D9306EABA6F448184B6837A9A6D4F3CA37170A951087B1
Malicious:	false
Preview:	p...... .........<..^)..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.0714816562741465
Encrypted:	false
SSDEEP:	48:Ydo+eHIYH8TFSGTFXwiTFgCTF3bTFDL0ToT3UTpNMaTN:FhoJLWNMu
MD5:	F549950EF7D7A4132C03631C9226C95A
SHA1:	9EE554E08E0082A25078B0C3A446A8CABB419667
SHA-256:	E3D89E4658A8B242BDDC32AD93D232D8E1DCA2B59531055625C3870A4F9F5CD6
SHA-512:	41BF2C0F2D34A13E4F7AAF67F79C0FAE739A047E6FC4589D68440CA119156DFEAA0C854BB8C4CB62AF6D8E18536C302AC293DA2FDAF509A86158933DAB64A55E
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1730136542000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1f627a0ebb1619d115b1670685dc36d6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696494934000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1a6c845034c91b8f895804fd80befd78","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696494933000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"27da5dddbe5bafa6951ba0799b63a0fa","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696494928000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"52e4d71a3bec9e300fc55dce48c3c732","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1696493920000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c5e64480adba3de9b9cf370b71aefd47","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696493920000},{"id":"Edit_InApp_Aug2020","info":{"dg":"8b26a75f

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3202787422938904
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeNv0tqVS:TGufl2GL7ms9WR1CPmPbPahgypilIA
MD5:	E05DD58170B046AA578572D1F670AFC7
SHA1:	4823828F8CCC93A53A2737A88E79B67936264A05
SHA-256:	F235A52FE352E3B56860C2850113CB9927492110C43EB1A4CD431E74576DCD8C
SHA-512:	AC4146ED0C9C2E21F2AD1C0ABC573FD0505B28B215173B34A8257F29BEC70415EBD9C5F9DBA52B8199A7585883582EE46F13B488D377470C8CB6CC79A264C034
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7824886861382097
Encrypted:	false
SSDEEP:	24:7+tSlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeNv04qVpaVrScVr0InFfqLhA:7MZWR1CPmPbPahlypilIkfqFl2GL7msM
MD5:	A60AD22549D1DA433F4655B8E1C78A30
SHA1:	3FB8DF5CB548236E2957B1441D1E154EC8030F96
SHA-256:	74B5396C29DD1488616DAB014EF46B9BC4F64B53EEFAD788A9DFB98C4EBC718F
SHA-512:	6F23FF77134867B2A4EA20790D1AE873D974DB094AE0019819388D5D8608A20F643AA2781B17D91878B6615C1229C4EF27D7EFE462B4D4A016B352BEB2BFAACF
Malicious:	false
Preview:	.... .c........3..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI5204e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5325285763919316
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88q0le:Qw946cPbiOxDlbYnuRKi
MD5:	1236F4AD0C86402596BB8832F34D6464
SHA1:	E1846D10F1EB5F7CE90A228B2A93B6668BBD6D0B
SHA-256:	5AE84A2372AF6ADFCFA2C440EE68F723BB90FE6B4EAA529900A6B12A9FFA66A3
SHA-512:	95607289764A7A80FA379F7B22AA763D1143699338AE866AA18964DAD2A44A71F35AFAFE1EAEDB3D0AFC19E87465C41048B0EB7FA09B34FE2BB721EDD8642A4C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.8./.1.0./.2.0.2.4. . .1.3.:.2.9.:.0.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91evobgb_1s86il7_4cg.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9buap5j_1s86il6_4cg.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-28 13-29-01-083.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.353873518309344
Encrypted:	false
SSDEEP:	384:mNTYBYUYpYrYWYd57+7H87c7J767ju2uIBr30qIquqaqNqxqMqHqhDLuLGLk+q+J:YI/
MD5:	9524EC27D5CBD4B5A4799F08F9289078
SHA1:	3041B918FB6034833D0541EA41A96793824ABBA3
SHA-256:	2D2FA64E4F53B6ED9FFE651045048AE19753FB320D398F9E12FAF5AF384513CF
SHA-512:	A32E1BFF693E288D19FCCFA54C22ED2FE9D2A22FF030536BCC3202E750091F7C59C809C3B54235FD22D6CBC8B13797440D401605E536C1ADFC3F12836A891874
Malicious:	false
Preview:	SessionID=4242ad72-7ac9-49ff-87a7-f76d47cc5774.1730136541109 Timestamp=2024-10-28T13:29:01:109-0400 ThreadID=7564 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4242ad72-7ac9-49ff-87a7-f76d47cc5774.1730136541109 Timestamp=2024-10-28T13:29:01:113-0400 ThreadID=7564 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4242ad72-7ac9-49ff-87a7-f76d47cc5774.1730136541109 Timestamp=2024-10-28T13:29:01:113-0400 ThreadID=7564 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4242ad72-7ac9-49ff-87a7-f76d47cc5774.1730136541109 Timestamp=2024-10-28T13:29:01:113-0400 ThreadID=7564 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4242ad72-7ac9-49ff-87a7-f76d47cc5774.1730136541109 Timestamp=2024-10-28T13:29:01:113-0400 ThreadID=7564 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.405736717125489
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbTcbaI7ncbJ:ceo4+rsCW7M
MD5:	ACF8CF8057DFA1D67C407128F3875973
SHA1:	620A9054E2D4BD32CFC6A6295C8A3E16E366865D
SHA-256:	D896AAFF0851E6BB1A9D200D1E2863EFD12E28BBBD22C972EE523958D529283E
SHA-512:	AC2D4F09E7E759746D996D295C63D5A46533F6E6BA7B8C720A7863D2535EFE8CA4EB23B31ED3316CE80AB6F7A5BD88BF3925EC6E463482F5A23802172587D12A
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\39dbc172-6f7f-4600-8ca8-eb3a615310f7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gWL07okZwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxkZwZG6GZn3mlind9i4ufFXpAXkru
MD5:	ACB1B27818CEB36D0750207A9585D1DE
SHA1:	6F8E0D68875083DD83681391CE1C8304D0CF8C29
SHA-256:	BAB1F04D2DB8ADF240CFE93D51DFDA5CABE1D1DA91DCC807D2ABD93E030926D6
SHA-512:	AFE11C5D4A50430BE73E2D82081C6C02DB93A8368999C9139863A5A2DD0780066E020A5D2FDC94612E808862C8FB0CF90CA92E7CEAAAFEB4C3EA59703229B4AA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\62dcb786-9139-46bd-b3fa-82167a809293.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\7b925a26-1345-4880-a1c3-353745c6461e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a64e1611-8618-4dd2-af8a-b4a9872ac960.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1932
Entropy (8bit):	5.08899516795513
Encrypted:	false
SSDEEP:	48:sNHzwGnGbnGnGp5GeGnGpbHlGbFGgHlGCG+GelGaGGGaEGEGsGnGyGnGZGvGTG7v:sd8mJRnIv
MD5:	54796D146E3682E7B0C7389FE0B7FA20
SHA1:	BF9C03394EB4E5206C0F03ED5EF52E4868E68153
SHA-256:	99B6FF59005102CC04938D544CCF20D6DDAF204B9E4CFC0E66C13651CBE59410
SHA-512:	0B3D7A9EC45EB0A6E07D9AE4FF486A3D60BFE68B78724DC866A08ED1E2A549BA2CB01FD25AC6721CC3583498C2BBD333467153931E3622C232B1CF21738EE09A
Malicious:	false
Preview:	10/28/2024 1:29 PM: Unpack: C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar..10/28/2024 1:29 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\wu5ba1gq.lwu..10/28/2024 1:29 PM: Received from standard out: ..10/28/2024 1:29 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..10/28/2024 1:29 PM: Received from standard out: ..10/28/2024 1:29 PM: Received from standard out: Scanning the drive for archives:..10/28/2024 1:29 PM: Received from standard out: 1 file, 11078157 bytes (11 MiB)..10/28/2024 1:29 PM: Received from standard out: ..10/28/2024 1:29 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar..10/28/2024 1:29 PM: Received from standard out: --..10/28/2024 1:29 PM: Received from standard out: Path = C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar..10/28/2024 1:29 PM: Received from standard out: Type = Rar5..10/28/2024 1:29 PM:

C:\Users\user\AppData\Local\Temp\wu5ba1gq.lwu\dps_tax_gov_ua_0739220983\??????????? ????? ?????????? ?????????? ??????.zip

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	11077719
Entropy (8bit):	7.999983913716094
Encrypted:	true
SSDEEP:	196608:Mp67DydJy1waU+7gu0lkQb1i6MXg8Cfkwk2QZ77vPvB4N3Zb9hP8tcnsvqAZI:j7Ko1wn+7gu0kQb1Xww+v6dh9hP8tesA
MD5:	61F03EDCAC487C38E350D5588FB3CC5C
SHA1:	69EF2CAD7F0E7C189ECF1149E378DB627BFD815C
SHA-256:	9AB1F67B51466F3721D84CF8065DB6722E451B4CBD2C98F0AFEA2CBF6353DB8F
SHA-512:	788C33DBC50631347C5B5E13B6861C227EC426CF117EBAC92D6CC51F0903317D32246A9B54E160FC0D8142F00E9EE25B4884B8077E1670922342A150231D6E02
Malicious:	false
Preview:	PK........@.\Y............Y.............. ..... .......... .......... ....../PK..........\YW.\.n...n.................. ..... .......... .......... ....../........... ..... .......... .......... .......pdf.rarRar!......_C!.......b..A.k....f.E..d..z..syy......9..i..Y.R$e..X...?.!.^Q.k..O..t=...q.I#...HB.O..l(.(...tW...;cw.k...J.eT.....Z..6.......L...........s.=..\|.....:TP!:..`M......i..]W..a2..}.[.N....J......K.....W.[.y.SQ...u....1P4...\|.l!,.P=._......AP..P.J....\...3Sd.C..G7..t..j..o...F...S..P...rPI..<./.-F......}=....&e.?t.}..eDS..=>F.....w..".S.-..c..,c..r.L..q@r.R......Vn..T1<..{..;..,..(+w...S.{.W..w..V%...+`...uR'.ph@.D..d>..!.p..}n..Mx$.T_3~a...d......q.r.c..2N.......8......`^_...6... ."....M..6-..!o.a...>......[I.a.E}.M1\|.....#..5E......S...U.4V.<../...o.......Q*...8.\......;..p..>......kmC>&....G.<...%&..SW

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.66829583405449
Encrypted:	false
SSDEEP:	3:So6FwHn:So6FwHn
MD5:	DD4A3BD8B9FF61628346391EA9987E1D
SHA1:	474076C122CACAAF112469FC62976BB69187AA2B
SHA-256:	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
SHA-512:	FDAF3D9F8072ED7DE9B2528376C10E3C3FDBEA74347710A4795BECF23C6577B3582B2E89D3C04EF0523C98FE0A46F2AF3629490701A20B848C63BA7B26579491
Malicious:	false
Preview:	<</Settings [/c <<>>].>>

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 16:29:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9817014313909844
Encrypted:	false
SSDEEP:	48:8gy0dJTR9JH7idAKZdA1oehwiZUklqehpy+3:81WLmOy
MD5:	2E9CCC5457C0D031A8E5148038DCDE08
SHA1:	36A263E4C30AE6EE424EB275558D993B3D7E0FD2
SHA-256:	9C24FE3A403FF084333FD23A905B20F65F4A07F3983E350979EFD9BDEBF0D555
SHA-512:	6DAA5009D7A301D95803544A2DF5F1322364466F2D5593CA0DC6A1080B0EC22B3CEA444907F8D1A96FCBABCFF5F44D39606F61C6B095EBC30C2D97854BB19CA2
Malicious:	false
Preview:	L..................F.@.. ...$+.,....g...^)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 16:29:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9978724625294464
Encrypted:	false
SSDEEP:	48:8HKny0dJTR9JH7idAKZdA1leh/iZUkAQkqeh+y+2:8HDWLk9QDy
MD5:	B4E8D50C1449868F47470EF5F25DE5B8
SHA1:	E20A6287A2494047F1BCF971076D5AE767609ACD
SHA-256:	BA7BDCFE26EEB8189D9C9A0AF87598247A9A5750A4201C70832CEA914A633602
SHA-512:	9D55537AFA5B539F218C18350D7517EDD861933F0EC879267561FF3806406A2574706B1BAB84F9FB6B8F49C4C4F295A6CB7F935CC98BE1206B87EE20E5E884F3
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......^)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.009341997809042
Encrypted:	false
SSDEEP:	48:8Cy0dJTR9bH7idAKZdA14t5eh7sFiZUkmgqeh7s4y+BX:87WLSnyy
MD5:	F287A8CCD39C3FC614471FCC3B84CF4F
SHA1:	C67198CF257996E9D1F13322949A23834B059DA0
SHA-256:	7438399955B99F2CAE5FAA92F85D20F6336945970D0CEB449DB402B82C54C052
SHA-512:	92F37455A8DE7ADD71F2B61AFA3600BC0843FBA05A6FAF17A69E4B7C2128EBE039EE9BD34E974A3B6410CF6BB3FD4B7A5FA57CF20DFB6A88F5B6D494B83A51DE
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 16:29:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.997912020212468
Encrypted:	false
SSDEEP:	48:8Fy0dJTR9JH7idAKZdA16ehDiZUkwqehqy+R:8cWL/wy
MD5:	988A8215914471ACD59D539D84A5DAA7
SHA1:	CD2A5F54E2C831EEDA7EAC305053701F6F12ED76
SHA-256:	320177BC76914C7ED92E0A44670C936E64561AAAAB8546B6E01751F3D3543F18
SHA-512:	C30FF2E273CE176966C7179AE87379C2A21296E1774D34F712823F0C57156FDBEF593E75B3DE0E413976582C10E6D85BEC062C48EDD62302A8961AC19CA323E6
Malicious:	false
Preview:	L..................F.@.. ...$+.,....!...^)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 16:29:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9875505226138412
Encrypted:	false
SSDEEP:	48:8wy0dJTR9JH7idAKZdA1UehBiZUk1W1qehcy+C:8lWLf98y
MD5:	C00DD1D65C3977B82FB0DF72A7F9802F
SHA1:	48127339992C5357D833AE356F6647A95957F056
SHA-256:	1F7CF09E12641D3FE74BE17E81A135E49DF02E3AA4F019BE7CC374A1BADC88A6
SHA-512:	66F7E3E66584161BBD0FFE998345BEFA2768FCF8A87DDE3B1335A9A62DC46DCDBA13D45BB20B4213E2DDBFEBEC238EF0D26BBE39A6452987546FEE9FE2F79B16
Malicious:	false
Preview:	L..................F.@.. ...$+.,........^)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 16:29:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9946375511072607
Encrypted:	false
SSDEEP:	48:8HBny0dJTR9JH7idAKZdA1duTrehOuTbbiZUk5OjqehOuTbyy+yT+:8HByWLYTYTbxWOvTbyy7T
MD5:	411A9DB4D1278336B984707BCE1569E4
SHA1:	271177203046605CB7D9E326FAB776CFE29CE098
SHA-256:	F866F1C8DC02D020136682F16111EEDC0262A1078DDFB2BACD80AE40C5CBD84F
SHA-512:	EBB2FB31673B38BF2D3FD60A0EAE9EE33A4FD60CEC8B0FEFFA6D6DBFC2C8BF9C7AAAAB94C3E3D50FBF1950061B8EBB77B3E4D2984CE708A81E9482A26BD220CF
Malicious:	false
Preview:	L..................F.@.. ...$+.,........^)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	11078157
Entropy (8bit):	7.99998389725913
Encrypted:	true
SSDEEP:	196608:pp67DydJy1waU+7gu0lkQb1i6MXg8Cfkwk2QZ77vPvB4N3Zb9hP8tcnsvqAZ+:m7Ko1wn+7gu0kQb1Xww+v6dh9hP8tesG
MD5:	AF99C4959022D4EFE39E6A8C1366FF79
SHA1:	5A48440011C14EDC79E8FEC960601683F2401F71
SHA-256:	7D2F4E61BD5BE745EB43D09E66674AE7F99B0DA8AB4F939D0C853B0F9144C9BA
SHA-512:	768B9D656508774BBAAB0D20A479EE8AB090C6FD202BFF7F8691B72228CAAD8537A518852F3202498B2E3318DE17423DF0FD8E6CF98819B4296B3FE416DA0706
Malicious:	true
Preview:	Rar!........................U................. 'o^....vdps_tax_gov_ua_0739220983/........... ..... .......... .......... .......zip....Rr..(..PK........@.\Y............Y.............. ..... .......... .......... ....../PK..........\YW.\.n...n.................. ..... .......... .......... ....../........... ..... .......... .......... .......pdf.rarRar!......_C!.......b..A.k....f.E..d..z..syy......9..i..Y.R$e..X...?.!.^Q.k..O..t=...q.I#...HB.O..l(.(...tW...;cw.k...J.eT.....Z..6.......L...........s.=..\|.....:TP*!:..`M......i..]W..a2..}.[.N....J......K.....W.[.y.SQ...u....1P4...\|.l!,.P=._......AP..P.J....\...3Sd.C..G7..t..j..o...F...S..P...rPI..<./.-F......}=....&e.?t.}..eDS..=>F.....w..".S.-..c..,c..r.L..q@r.R......Vn..T1<..{..;..,..(+w...S.{.W..w..V%...+`...uR'.ph@.D..d>..!.p..}n..Mx$.T_3~a..

C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	11078157
Entropy (8bit):	7.99998389725913
Encrypted:	true
SSDEEP:	196608:pp67DydJy1waU+7gu0lkQb1i6MXg8Cfkwk2QZ77vPvB4N3Zb9hP8tcnsvqAZ+:m7Ko1wn+7gu0kQb1Xww+v6dh9hP8tesG
MD5:	AF99C4959022D4EFE39E6A8C1366FF79
SHA1:	5A48440011C14EDC79E8FEC960601683F2401F71
SHA-256:	7D2F4E61BD5BE745EB43D09E66674AE7F99B0DA8AB4F939D0C853B0F9144C9BA
SHA-512:	768B9D656508774BBAAB0D20A479EE8AB090C6FD202BFF7F8691B72228CAAD8537A518852F3202498B2E3318DE17423DF0FD8E6CF98819B4296B3FE416DA0706
Malicious:	false
Preview:	Rar!........................U................. 'o^....vdps_tax_gov_ua_0739220983/........... ..... .......... .......... .......zip....Rr..(..PK........@.\Y............Y.............. ..... .......... .......... ....../PK..........\YW.\.n...n.................. ..... .......... .......... ....../........... ..... .......... .......... .......pdf.rarRar!......_C!.......b..A.k....f.E..d..z..syy......9..i..Y.R$e..X...?.!.^Q.k..O..t=...q.I#...HB.O..l(.(...tW...;cw.k...J.eT.....Z..6.......L...........s.=..\|.....:TP*!:..`M......i..]W..a2..}.[.N....J......K.....W.[.y.SQ...u....1P4...\|.l!,.P=._......AP..P.J....\...3Sd.C..G7..t..j..o...F...S..P...rPI..<./.-F......}=....&e.?t.}..eDS..=>F.....w..".S.-..c..,c..r.L..q@r.R......Vn..T1<..{..;..,..(+w...S.{.W..w..V%...+`...uR'.ph@.D..d>..!.p..}n..Mx$.T_3~a..

C:\Users\user\Downloads\d9c1edb4-b1c2-47d1-bddb-032ba20a935b.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	32349
Entropy (8bit):	7.991825961242124
Encrypted:	true
SSDEEP:	768:NZSF73JJdWPhs8WZXYIuXyEwXDMyjTyjHJf4zvZ:NZEKs8W1YIYp+k14zvZ
MD5:	34D788BEB4BE787B6EBC7A97497296CB
SHA1:	8A228B1EDE9CDADE8EF98693B718D4120BE3AB3D
SHA-256:	590397C984B6FF095DE57D99F9B29895794734CE66AB69FB9D5569F099A59EB4
SHA-512:	C293B3BF406D89BA6F25D30B3BCBB32D5B13803E6A6E1DF4E5F3A870464812CA8739F9E7196D3B3049E8698169C7197F7A4906C026A5F9EC9C116FC9D532533D
Malicious:	false
Preview:	Rar!........................U................. 'o^....vdps_tax_gov_ua_0739220983/........... ..... .......... .......... .......zip....Rr..(..PK........@.\Y............Y.............. ..... .......... .......... ....../PK..........\YW.\.n...n.................. ..... .......... .......... ....../........... ..... .......... .......... .......pdf.rarRar!......_C!.......b..A.k....f.E..d..z..syy......9..i..Y.R$e..X...?.!.^Q.k..O..t=...q.I#...HB.O..l(.(...tW...;cw.k...J.eT.....Z..6.......L...........s.=..\|.....:TP*!:..`M......i..]W..a2..}.[.N....J......K.....W.[.y.SQ...u....1P4...\|.l!,.P=._......AP..P.J....\...3Sd.C..G7..t..j..o...F...S..P...rPI..<./.-F......}=....&e.?t.}..eDS..=>F.....w..".S.-..c..,c..r.L..q@r.R......Vn..T1<..{..;..,..(+w...S.{.W..w..V%...+`...uR'.ph@.D..d>..!.p..}n..Mx$.T_3~a..

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.021127689065198
Encrypted:	false
SSDEEP:	48:p/hUI1atAdI567akUmYWEFw/3+ovGJ4F3jkZUbvzk98g5m7:RnYQI47avYUwvVGJ41jkZIzxgA7
MD5:	68E6B5733E04AB7BF19699A84D8ABBC2
SHA1:	1C11F06CA1AD3ED8116D356AB9164FD1D52B5CF0
SHA-256:	F095F969D6711F53F97747371C83D5D634EAEF21C54CB1A6A1CC5B816D633709
SHA-512:	9DC5D824A55C969820D5D1FBB0CA7773361F044AE0C255E7C48D994E16CE169FCEAC3DE180A3A544EBEF32337EA535683115584D592370E5FE7D85C68B86C891
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiIyNXB3SWdtQWU2QTVoeDVVTG9OV0laODBLbzJjbktOTHpacUdjbjlLT2c4In0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiOWVza0FuRlBsM3VCQzkwUmFWakxNaVI3NXZIQi0wQUVmMmg0RzU3ZXNpcyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC44LjEwLjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"dU2MmRUQSugaJAJvEN4uaQHx-KXdOkjj0yK8_aH4Afr3kN7DPOZRt6yLTS3UchBE5M-dgPPPBuKADj4KEK4B22SO6WQquL5J27AUPqQBGgr44-iFGVJdOLLlfirFlJmcYv6DUFRYiPsQFGMr1JFqInj19jgkOxzR6qqcNuTCB0wGEMeTU80r-igCjeQG6TIzPro7yKd_-UxsxO6OGAySmlIJIoU54X0p0ATNoZyAfkhb8kb0oN8unOU

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9159446964030753
Encrypted:	false
SSDEEP:	3:Sq5TQRaELVHecsUDBAeHD5k:Sq5gJ+csHej5k
MD5:	CFB54589424206D0AE6437B5673F498D
SHA1:	D1EF6314F0F68EFDD0BA8F6CA9E59BFF863B1609
SHA-256:	285AC183C35350B4B77332172413902F83726CA8F53D63859B5DA082FD425A1C
SHA-512:	70FDCA4A1E6B7A5FFED3414E2DB74FECA7E0FD17482B8CB30393DFEE20AB9AD2B0B00FF0C590DD0E8D744D0EAD876CE8844519AF66618ED14666BCA56DF2DA21
Malicious:	false
Preview:	1.dbf288588465463a914bdfc5e86d465fb3592b2f1261dc0e40fcc5c1adc8e7e4

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.4533115571544695
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1tean:F6VlM8aRWpqS1ln
MD5:	C3419069A1C30140B77045ABA38F12CF
SHA1:	11920F0C1E55CADC7D2893D1EEBB268B3459762A
SHA-256:	DB9A702209807BA039871E542E8356219F342A8D9C9CA34BCD9A86727F4A3A0F
SHA-512:	C5E95A4E9F5919CB14F4127539C4353A55C5F68062BF6F95E1843B6690CEBED3C93170BADB2412B7FB9F109A620385B0AE74783227D6813F26FF8C29074758A1
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.8.10.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1211409625\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9748
Entropy (8bit):	4.629326694042306
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJq:v5C4ql7BkIVmtRTGXvcxBsq
MD5:	EEA4913A6625BEB838B3E4E79999B627
SHA1:	1B4966850F1B117041407413B70BFA925FD83703
SHA-256:	20EF4DE871ECE3C5F14867C4AE8465999C7A2CC1633525E752320E61F78A373C
SHA-512:	31B1429A5FACD6787F6BB45216A4AB1C724C79438C18EBFA8C19CED83149C17783FD492A03197110A75AAF38486A9F58828CA30B58D41E0FE89DFE8BDFC8A004
Malicious:	false
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\Filtering Rules

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	74598
Entropy (8bit):	5.5368864380577545
Encrypted:	false
SSDEEP:	1536:7geXUzNNSGg1dSkNp+z55w4kgNmmO6I7kWvQFlGlHUvkS6xt/GL95vkdwz:sDRNfgr9NpK5wl+1O6IoWQFlGlHLS6xQ
MD5:	C6AF15DA82A8A9172FC9CAFC969DE4F9
SHA1:	81F477E181036D551EF6F09CB875C6B280BEBE00
SHA-256:	782009D9765C6104A1B4D1EAC553834E7E399D749A082EAD42BB47ABB42895B5
SHA-512:	F541CB1703A0BD31FCB6E293ACBC6E20F73B365FF8D2270A6D44780E9D5731B8D7803AECACD49D73E0DA065DD1026C9FA95F9CAD2BF0776CE1E2C3C9FCA052C6
Malicious:	false
Preview:	............0.8.@.R.-728x90...........0.8.@.R.adtdp.com^..........0.8.@.R.just-news.pro^..........0.8.@.R.yomeno.xyz^..........0.8.@.R.yellowblue.io^..........0.8.@.R.thubanoa.com^..........0.8.@.R.abh.jp^..........0.8.@.R.ad999.biz^..........0.8.@.R._468_60...........0.8.@.R.adrecover.com^..........0.8.@.R.pemsrv.com^..........0.8.@.R.mnaspm.com^..........0.8.@.R..ar/ads/.,........0.8.@.R.mysmth.net/nForum//ADAgent_.>...........worldstar.com0.8.@.R.js.assemblyexchange.com/wana..(........0.8.@.R.ogads-pa.googleapis.com^..........0.8.@.R.indoleads.com^.%......0.8.@.R.discordapp.com/banners/.(........0.8.@.R.looker.com/api/internal/.#........0.8.@.R.broadstreetads.com^.(........0.8.@.R.shikoku-np.co.jp/img/ad/..........0.8.@.R./banner.cgi?..........0.8.@.R./in/track?data=.!......0.8.@.R.linkbucks.com/tmpl/..........0.8.@.R.clicktripz.com^..........0.8.@.R.-ad-manager/........0.8.@.R.files.slack.com^.$........0.8.@.R.admitad-connect.com^..........0.8.@.R./300-250-.2........0.8.@.R"cloud

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\LICENSE.txt

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24623
Entropy (8bit):	4.588307081140814
Encrypted:	false
SSDEEP:	384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD
MD5:	D33AAA5246E1CE0A94FA15BA0C407AE2
SHA1:	11D197ACB61361657D638154A9416DC3249EC9FB
SHA-256:	1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
SHA-512:	98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B
Malicious:	false
Preview:	EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	5.97509175092227
Encrypted:	false
SSDEEP:	24:pZRj/flTHY4NukYbKcFjeT3U8zkaoX+UqiF46u9ILn9oXUMzniumZ39TzIS/Xre:p/h44SbKcETEwkakBa6F9kUpumZR/Xi
MD5:	951BA6192A41622EC0E04174E1EFA31C
SHA1:	2C63243A5589671BF649FA049542308D3D7EB40E
SHA-256:	EA426C8FDAFABF1B3162C206175A17100613C85A0C30DDCDC0A3434232B69D59
SHA-512:	F9C612AA2848C01C2A3294378E6707AE92638FC5EF4C6C911D400AA981418AEF0334DBFAB1D954E0666ECDD5AB8B1506354D9C6DCF6D3D1459FAC2AD06F9E23E
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJGaWx0ZXJpbmcgUnVsZXMiLCJyb290X2hhc2giOiJ1VkRrWHp2UWlFeHdiRGtPWHNQdWtuXzI3ZGdIbGhPdDRQeENEZ0JnUXhRIn0seyJwYXRoIjoiTElDRU5TRS50eHQiLCJyb290X2hhc2giOiIyaWswNmk0TFlCdVNHNWphRGFIS253NE9pdnVSRzZsQ0JKMVk0TGtzRFJJIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6IlhiOTU4SjJabnFtQzJRMzBYclJFNl9acURIQU9VZFRKaFdyNzV6SnVuV2sifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJnY21qa21nZGxnbmtrY29jbW9laW1pbmFpam1tam5paSIsIml0ZW1fdmVyc2lvbiI6IjkuNTIuMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"534ZoaSA4vZpcy0b1OYq4wgLlduJCzBpUCZnNXyx3UoH1ihy6uYapK85BVjJa1ptpN9OiT86GN1r8DNZlX69tLTIyTb7lSKoX31Sef3uvZpSLJBlIGI1173pGoj52Eu77I4DraCiKTVQ4mtVLBee579FqGijozIApfrepXVZeIes4wac06yB06DuFkdEg_jnCv3xR2twcNzidsDVTw7W-VOezjdZgjousBDON_Pumwd7_4ze5

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8945408555413215
Encrypted:	false
SSDEEP:	3:SjWMQ0GiUVfkCzNMEkDRApvTD:SjWR/3tkNApvTD
MD5:	87190EF44A670A5418E7E6B26DA5CF02
SHA1:	7F24A0F6E188CA285526C968359D5DEEB0CA3F1C
SHA-256:	B9C7B754CFFECA3981CA26BCFEC1FA9988070C8657AE9DA3CA2EA7944E16AB00
SHA-512:	2980EBB51CCEE91B7F887A49D495BA9E3F4D0274AA6D4D0A3E8E4D3E3661815FB825C6D44DAFA34285E3625F979084FFAD5D54E8AE0B9E12ABFEF5C2F71E568C
Malicious:	false
Preview:	1.b48b30af5ce18c96128bfff9d2755c7932a1f32adc66f68322f7dd505db9626f

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1236057237\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.547350270682037
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFHXG7LGMdv5HcDKhtUJKS1HVgn:F6VlMZWuMt5SKPS16n
MD5:	3EE731D0E5BFB74CACB3D9E2DFDC7768
SHA1:	EE15CB60213BB402FD90308F0F67D7B6160C9751
SHA-256:	5DBF79F09D999EA982D90DF45EB444EBF66A0C700E51D4C9856AFBE7326E9D69
SHA-512:	F38E3FEDD392F9B273565CBE321A56051EDAF48DB75A0EBB539D57E8D1238D4BAC41E973F037395F9C5D4A189DF5E68726ED2C000134FC36BB7E7295C9A779C1
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Subresource Filtering Rules",. "ruleset_format": 1,. "version": "9.52.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1314818920\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1796
Entropy (8bit):	6.029068962991477
Encrypted:	false
SSDEEP:	48:p/hKGI1W/SQpFNjSr7aksmJcXvGrLhG+j48PVSTkkiHyAO+VYSZlR945d:RszQSQsr7a7JXvYLhH9oTBkPO+Vlb2
MD5:	3C40424282DF44F4C7498EFAD406B4F5
SHA1:	3C4451906DB467567F432598A0A7F37542E03D40
SHA-256:	11A7ECB86583C3A2694B9154BD1D1D5D1BB114D5808900127A052DE87FC28D80
SHA-512:	FAA5483F363EDF8EB1D2687E5B8FF9483689E4BEF8CB963F5CDEDF2DF9A283C993D34EA54F90AAC1305D5FEBD347D727C44831967E0709DCFBE5589CD29C60B8
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJjcl9lbi11c181MDAwMDBfaW5kZXguYmluIiwicm9vdF9oYXNoIjoidkhNeUROX1g4RWN4dXFzdVZJblQ0ZWNLOGRzQjY1QnU1VFZ4d25pWUFDQSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJ3MFFJaHRKSVhuZ21tZC1qeXV3SzFvSm5SSHFmQlZOZWJ6OU9kbGdLVlhrIn1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoib2JlZGJiaGJwbW9qbmthbmljaW9nZ25tZWxtb29tb2MiLCJpdGVtX3ZlcnNpb24iOiIyMDI0MTAxNC42ODc5NDY5NTUuMTQiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"fP3QVRzQFcNiAsdD1nolC0CVViBsa4DfOx5NCYyPxE31iNVQ1O0xUjkg0xEboh7K-KVlFcF3Wq1FahUcSpM941qPr6H1MgaH_RcM7avC9rI9fgD0P8sarXK1O5ldgMvjVY9o9BYazbfPUZGRJySGvwGgd1L2qx8lzBJFhYHmz_UYAvPPIJWGSL68GPbFtNcn_lgkeRbS5910MoZ8ebcuyEQf-fmHieLbAivh46jjGsiDpTFMeGSUAlJQyF04OGOAVv8pfI3zoIBSvsjocNs8-1Ql9OZc-wKeTVzB3WiUVBVwDjfet8DtmN9y1Ep

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1314818920\cr_en-us_500000_index.bin

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	7945084
Entropy (8bit):	6.568436316582925
Encrypted:	false
SSDEEP:	98304:q2AfqCr/tSVgy52QxeLFEbDu89vR97++HbayrRY1df4xX0dq4FnL5dKHTmFrkyCT:q7Zjc+E+89H+ldd5QHCFrkyC5l
MD5:	929691B9629482DD6BDD9B02B225A73B
SHA1:	9E069E2C6E45883766A39F1F8CA3C342DF4D50CB
SHA-256:	E291651CB174CAEA475D5716A1A95A6C6757FA4A1672ECBE749CE72CCD25674D
SHA-512:	0498AAA36C10A3FB35DDA433E3AC8FAB40944669A7660A7A3B7F03E0F31763DE694BFCBAF40066460DFF74DF3985B958ECD9E9ED905773CCA597D3A5A43B2A9B
Malicious:	false
Preview:	......w.....a....h.. ..f{.1..y.v:..t..;..r1?J..g..R..c].Z..e.Jo..d..u..l=....n....b....m;....i....p.....u_....k.....sq....os....z.....vqx...j.....x.Z...1a....4s....q.-...5+....2.A...9.....3.B...7....6.....8.....0.G.....Q....X..../Y.....Y.....Z....![...&.]....'_.....a.....b...$.b....{k.../.l.....l.....n....... .o...-cp..........".... meaning..... to usd......p......p....]q.....q..... meaning.....Yr...)yr..... meaningL..............r...#.r..... meaning6=..(.s....dgar guzm.n l.pez....@.t.....t..... meaning,.....u....eviriN..... meaning......u........ ......Bm.... meaningH2....r eldon.-..... ............ meaning4...... .... 2024L.. . .... ..............-v..... meaningz....sad.ra bjarkard.ttir barney*j..... .....i.... meaningR^.... meaning.\...... 14.P.... meaning......v....p..... meaning...... meaning.o..........\...$ artist.[..... .....

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1314818920\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9075332333433215
Encrypted:	false
SSDEEP:	3:StRAiESUArMidStiATEdSTTGv:S8SytUAgT
MD5:	C4E9B6D6ED3ADD0FB5277CE0D56EEB9E
SHA1:	23452837F3182C7254D6200DC274C306919FFE01
SHA-256:	E508CF012CA85EDEF6AF364B5173F673C1D4FAA42D54A7795571D749546D570F
SHA-512:	B452D8DCC45632335BE90C7643FD03AF11477AE0A9D15695848283E56060C62912B1533FCB9FCE8AA6F003199A2A5987A7EADF1B1E035A06788D5DEB2FE29F64
Malicious:	false
Preview:	1.b3de84eee8b96a71eba91b28ef229c53db12ad48766df74d4b0cd6a87631ca6a

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1314818920\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.92582216972203
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifF0AAGAR3CKG/w/VpKS1/Yxn:F6VlMT2C7Y/VUS1gn
MD5:	89816FE14BE290E217AA23EA4DD860CB
SHA1:	96F41C28309DF716330DA186C165547054B0BA45
SHA-256:	C3440886D2485E782699DFA3CAEC0AD68267447A9F05535E6F3F4E76580A5579
SHA-512:	7E8A7EE9199F1887DF1B1ADF718FC55B35FE9D08B5CFD1C0BD3FDDC6B7FE6FC60D62BBDCFE09E2211BA284BDDE643940B5B48E087F4BBBB96D2964C31A68E17A
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "OnDeviceHeadSuggestENUS500000",. "version": "20241014.687946955.14".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1677436516\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1766
Entropy (8bit):	6.000181192139007
Encrypted:	false
SSDEEP:	48:p/hnWOXVApXJkNkak8YeQrGR+n+Q2shqoYk4ZxaO95uoQ:RtVWaTQyR+hDYHZIMuT
MD5:	64C9E00022F18E7E1F719BCBCE5D2F6D
SHA1:	6CBB0E992C8FC4439EB7D84BF54AD6A27584AA9B
SHA-256:	D9AC3B59C2101500A84E408C500608DC9F3DA99D0BE6A0A30920DD528786E568
SHA-512:	32D65EFA91A470D00DCA2CE169D7CF10789BB438CEB4563072E5D2E0EE804A7FF82FF3D0DD2D554D22A2AEF40582FDC2FFD123EF1452B98FB18ECB7599C286E7
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiR1BweHp1U0w5dEtLaEZOZHpsclZFQjRURUY1elRrZ0tTc1pSZzRQQTI2RSJ9LHsicGF0aCI6Im9wdGltaXphdGlvbi1oaW50cy5wYiIsInJvb3RfaGFzaCI6InFTWWJLdmg5eC04NjVOb0RDMVN1ZHZvM1c3YWxRbkxScElvZEZBZjBmU1UifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJsbWVsZ2xlamhlbWVqZ2lucGJvYWdkZGdkZmJlcGdtcCIsIml0ZW1fdmVyc2lvbiI6IjQ3MiIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"Jmb4z3dV7OPRzba2KBtuM_8yRCW3wU8eM9qqPUR5Sj-uETqmmrtBWjuoxCR2N5ImFq9FeiSCJX7wsHjF-9SwPn1uBAgVD0T2mu97TgvbGxEYXZSI1NhjuJ0zi9R7DHZcXCamlM-rCp29UCu1MiqtvvpI3ioPyTFfdYKzys2tik6c3O-jt_OaCQZdmJHKaUkM-rbqhoRoZvntdus5Oc6tmcEZQlypBxkNz4PjHpZzmVVwGqsJcVSQM6WRdKuhw8f5fC600N1WH_d7y_RJ3qQMOblCNYE8kcNwCRvXqqaVwGGBKh33InawvJHElw6zD57E1-lcdq8YrnBw4dsOneVg2kc9w

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1677436516\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9477608398895883
Encrypted:	false
SSDEEP:	3:ShKKiccTDTCXg4eVAQ:Sh+DTCQL7
MD5:	DD9D1F5D9387EC53D828634A39523726
SHA1:	360293C0A9DF564BE5B19D5FE195C5C0A75CEED1
SHA-256:	84550EF8F5F89EEA600B22A5FDCFD179AF9A6EFBA937640CE98F68ABC82898E4
SHA-512:	699C6CEC0E30743A605FD0D772F6B1E7DB10FCB9B60BBB7AA57118E97BDC481D12760E9C31C770149445B780FBF432F707242A98E56BEED919B87094AA3F5BDD
Malicious:	false
Preview:	1.eaedf48535e77597911d4b0d84aa275e6280e7f905c4596ca064a4f3e1b0f969

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1677436516\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.462631361764747
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFzIe4/+S1u3HcDKhtH8tAn:F6VlMQ/+S1u3SKH8tAn
MD5:	C589FDB7B4A9024BBAEC266EDFDD3E11
SHA1:	B74ADACA2D7A0ABA0B2A8BF5A0007266082923CE
SHA-256:	18FA71CEE48BF6D28A84535DCE5AD5101E13105E734E480A4AC6518383C0DBA1
SHA-512:	7CF88B18B019E18262A97D345222A28D3190482D7992525FCD705AA1B539CBCE2607B9EB6A2353849E22B41AD3F2A96C6C2F58DD69013A6CBDE50B35FBD3D8C1
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Optimization Hints",. "version": "472",. "ruleset_format": "1.0.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_1677436516\optimization-hints.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	53768
Entropy (8bit):	7.976279352177198
Encrypted:	false
SSDEEP:	1536:/zehGBKxdYm83YG3iHb8fZANCdX4SjsxgSH8:x0xW3YG3i78fZk67jsY
MD5:	4DD7496963001050A3BBF310AC0F417B
SHA1:	74060F19D7BCF4091C8CFE72B950633A45A14160
SHA-256:	8434308FCFC868C0F834EC70ADB38FAD1968D9B2C20BD81BE921E23D1597BCEC
SHA-512:	9BA56F15764C2D290BC5E5F317747EE653422142465788EBC676DFF59E81EB5DEF7E522CC7D1A9DE87D125DCF97708A6F085840668EE2599444E8C0B36741E4F
Malicious:	false
Preview:	............I.....g2.I..jI..n).+..)...h.+.A7p..q.:S4.Z...O.. R..\|....Da.e.?..W.-..ni2.....[.....6%8....x..y".b.Y7^.n......%/...f..c../.CY....j..\|].b..+.f..].{S.s..J...\|..nn..G..jb).Mn..../....R%.Fm.....K.....&.n.P.]..M.q:E..#^..O.....+...%\|{....5d..............=....X......._...OS1...+.q...7..vzf.....(....iVp....7..."QA.k`......Q...Y../X4..`...<+.@.U...m .'.X6...-.aD....<..w..7bv.e......<~.J.d...i..7..o}x_...B.T....V.et....u.{/.....p6.....t.Y(a.E......t.....P..45.a...!B-......B.RY#H....E....%...I..a.....$...T....7;...y..`.l.p..kv..`..q]...z.9rX...Rb..Q.N..../.>....p.ah.........z.\.Y}2W..o.?..-6=y...2[:..t7(t)....^.H...cl"]F."..@'h....t..s..Pf..SA.yCs....IuT..=.6...{...X....,...}.....ddE.2............YU..HQ..h.i.v...;..b....}.]K..../O.....]S~.l.H...........&....~m....3..l.l*RN"..k..1f.x.$..n...P-..](.Z./.........9...WJ\. /.B.Q....h.R...e.............Fg]...........?.Z..iH.Kyxc.e.P...H.....1N.Ac.;.4..he..b.V.w..'.....Z...K.4......p...2..9.s.."

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\Google.Widevine.CDM.dll

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2877728
Entropy (8bit):	6.868480682648069
Encrypted:	false
SSDEEP:	49152:GB6BoH5sOI2CHusbKOdskuoHHVjcY94RNETO2WYA4oPToqnQ3dK5zuqvGKGxofFo:M67hlnVjcYGRNETO2WYA4oLoqnJuZI5
MD5:	477C17B6448695110B4D227664AA3C48
SHA1:	949FF1136E0971A0176F6ADEA8ADCC0DD6030F22
SHA-256:	CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
SHA-512:	1E267B01A78BE40E7A02612B331B1D9291DA8E4330DEA10BF786ACBC69F25E0BAECE45FB3BAFE1F4389F420EBAA62373E4F035A45E34EADA6F72C7C61D2302ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: _Play__New__VM__01min 04sec____ATT2006587654 (Randiwestbrook) .htm, Detection: malicious, Browse Filename: attachment(1).eml, Detection: malicious, Browse Filename: sample.pdf, Detection: malicious, Browse Filename: Technical_Technical_Specifications_&_Data_for_Optimized_Process.html, Detection: malicious, Browse Filename: phishtest.html, Detection: malicious, Browse Filename: DRL-272112.htm, Detection: malicious, Browse Filename: ATT037484_Msg#189815.html, Detection: malicious, Browse Filename: Project_Proposal_Review_and_Approval13617.pdf, Detection: malicious, Browse Filename: ordine.pdf, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.TrojanX-gen.16449.26967.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....fd.........." ......(..........A&.......................................,.......,...`A.........................................V......V......`,......`+..p....+. )...p,......D.8....................C.(.....(.8...........p\..............................text.....(.......(................. ..`.rdata..h.....(.......(.............@..@.data....l......&.................@....pdata...p...`+..r.................@..@.00cfg..(.....+......p+.............@..@.gxfg....$....+..&...r+.............@..@.retplnel.... ,.......+..................tls.........0,.......+.............@....voltbl.D....@,.......+................._RDATA.......P,.......+.............@..@.rsrc........`,.......+.............@..@.reloc.......p,.......+.............@..B........................................................................................................................................

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1778
Entropy (8bit):	6.02086725086136
Encrypted:	false
SSDEEP:	48:p/hCdQAdJjRkakCi0LXjX9mqjW6JmfQkNWQzXXf2gTs:RtQ1aaxXrjW6JuQEWQKas
MD5:	3E839BA4DA1FFCE29A543C5756A19BDF
SHA1:	D8D84AC06C3BA27CCEF221C6F188042B741D2B91
SHA-256:	43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
SHA-512:	19B085A9CFEC4D6F1B87CC6BBEEB6578F9CBA014704D05C9114CFB0A33B2E7729AC67499048CB33823C884517CBBDC24AA0748A9BB65E9C67714E6116365F1AB
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJHb29nbGUuV2lkZXZpbmUuQ0RNLmRsbCIsInJvb3RfaGFzaCI6Im9ZZjVLQ2Z1ai1MYmdLYkQyWFdBS1E5Nkp1bTR1Q2dCZTRVeEpGSExSNWMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiYk01YTJOU1d2RkY1LW9Tdml2eFdqdXVwZ05pblVGakdPQXRrLTBJcGpDZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5laWZhb2luZGdnZmNqaWNmZmtncG1ubHBwZWZmYWJkIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjI3MzguMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"KTPeHzS0ybFaz3_br3ASYWHjb6Ctul92067u2JMwtNYYm-4KxLiSkJZNBIzhm6hNSEW2p5kUEvHD0TjhhFGCZnWm9titj2bqJayCOAGxZb5BO74JJCRfy5Kwr1KSS4nvocsZepnHBmCiG2OV3by-Lyf1h1uU3X3bDfD92O0vJzrA8rwL2LrwIk-BolLo5nlM0I_MZwg8DhZ8SFBu9GGRVB2XrailDrv4SgupFE9gqA1HY6kjRjoyoAHbRRxZdBNNt9IKNdxNyaF9NcNRY8dAedNQ9Tw3YNp5jB7R9lcjO4knn58RdH2h_GiJ4l96StcXA4e7cqbJ77P-c

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.974403644129192
Encrypted:	false
SSDEEP:	3:SLVV8T+WSq2ykFDJp9qBn:SLVqZS5p0B
MD5:	D30A5BBC00F7334EEDE0795D147B2E80
SHA1:	78F3A6995856854CAD0C524884F74E182F9C3C57
SHA-256:	A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
SHA-512:	DACF60E959C10A3499D55DC594454858343BF6A309F22D73BDEE86B676D8D0CED10E86AC95ECD78E745E8805237121A25830301680BD12BFC7122A82A885FF4B
Malicious:	false
Preview:	1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7568_521230152\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.595307058143632
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFooG+HhFFKS18CWjhXLXGPQ3TRpvF/FHddTcplFHddTcVYA:F6VlM5PpKS18hRIA
MD5:	BBC03E9C7C5944E62EFC9C660B7BD2B6
SHA1:	83F161E3F49B64553709994B048D9F597CDE3DC6
SHA-256:	6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
SHA-512:	FB80F091468A299B5209ACC30EDAF2001D081C22C3B30AAD422CBE6FEA7E5FE36A67A8E000D5DD03A30C60C30391C85FA31F3931E804C351AB0A71E9A978CC0F
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "windows-mf-cdm",. "version": "1.0.2738.0",. "accept_arch": [. "x64",. "x86_64",. "x86_64h". ].}

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RAR archive data, v5
Category:	downloaded
Size (bytes):	11078157
Entropy (8bit):	7.99998389725913
Encrypted:	true
SSDEEP:	196608:pp67DydJy1waU+7gu0lkQb1i6MXg8Cfkwk2QZ77vPvB4N3Zb9hP8tcnsvqAZ+:m7Ko1wn+7gu0kQb1Xww+v6dh9hP8tesG
MD5:	AF99C4959022D4EFE39E6A8C1366FF79
SHA1:	5A48440011C14EDC79E8FEC960601683F2401F71
SHA-256:	7D2F4E61BD5BE745EB43D09E66674AE7F99B0DA8AB4F939D0C853B0F9144C9BA
SHA-512:	768B9D656508774BBAAB0D20A479EE8AB090C6FD202BFF7F8691B72228CAAD8537A518852F3202498B2E3318DE17423DF0FD8E6CF98819B4296B3FE416DA0706
Malicious:	false
URL:	https://qaz.is/load/fK7NR3/668d3238-49f0-4207-9478-4e8005840fbb
Preview:	Rar!........................U................. 'o^....vdps_tax_gov_ua_0739220983/........... ..... .......... .......... .......zip....Rr..(..PK........@.\Y............Y.............. ..... .......... .......... ....../PK..........\YW.\.n...n.................. ..... .......... .......... ....../........... ..... .......... .......... .......pdf.rarRar!......_C!.......b..A.k....f.E..d..z..syy......9..i..Y.R$e..X...?.!.^Q.k..O..t=...q.I#...HB.O..l(.(...tW...;cw.k...J.eT.....Z..6.......L...........s.=..\|.....:TP*!:..`M......i..]W..a2..}.[.N....J......K.....W.[.y.SQ...u....1P4...\|.l!,.P=._......AP..P.J....\...3Sd.C..G7..t..j..o...F...S..P...rPI..<./.-F......}=....&e.?t.}..eDS..=>F.....w..".S.-..c..,c..r.L..q@r.R......Vn..T1<..{..;..,..(+w...S.{.W..w..V%...+`...uR'.ph@.D..d>..!.p..}n..Mx$.T_3~a..

Static File Info

General

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.886228685678867
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	37429345.pdf
File size:	91'323 bytes
MD5:	94391b5ded68319abaa7511b25e3661d
SHA1:	5b46961aa35ce1a8700c6db46132e1412a4aa23e
SHA256:	9f678c529e6a46f3cb2e5213932c5e235ac806ee064dd23336170e32ba29f5f9
SHA512:	1a097c84e293e196ed04fa408856a29b929a9303ec48897bcaeb68ccb472abdc477cdaade8a03b07a403ffbb1508df267535ba8ad3e53f06082babbce100ae7d
SSDEEP:	1536:7HforYaJ+VqpGXMlBL3GzHYKulXkzg/ngrcYnIA5+Ua/icXEEspaPGQ8YkvVA:TSVJ+Vq/3GjYKu2zg/WcSNdzcXEEspml
TLSH:	DC93CF078C085A83D964DBF97F1BAC9E6E1A371DD5C172E6702D8FC76B20A312C4B526
File Content Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 19 0 R/MarkInfo<</Marked true>>/Metadata 54 0 R/ViewerPreferences 55 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/R

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.7
Total Entropy:	7.886229
Total Bytes:	91323
Stream Entropy:	7.907098
Stream Bytes:	86138
Entropy outside Streams:	5.275805
Bytes outside Streams:	5185
Number of EOF found:	2
Bytes after EOF:

Keywords Statistics

Name	Count
obj	28
endobj	28
stream	8
endstream	8
xref	2
trailer	2
startxref	2
/Page	1
/Encrypt	0
/ObjStm	1
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
17	c8b0b0542c2a6968	43da7b70fe460875c8359a16959faf91

Target ID:	0
Start time:	13:28:57
Start date:	28/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\37429345.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:28:58
Start date:	28/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:28:59
Start date:	28/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2044 --field-trial-handle=1612,i,2609987279070104200,10577324592718449673,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:29:22
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://qaz.is/load/fK7NR3/668d3238-49f0-4207-9478-4e8005840fbb"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:29:23
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1896,i,12452905871821157740,5775890423641875054,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:29:44
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar"
Imagebase:	0x8e0000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:29:45
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\wu5ba1gq.lwu" "C:\Users\user\Downloads\1473272810.dps_tax_gov_ua_17622653645.rar"
Imagebase:	0xea0000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:29:45
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.5%
Total number of Nodes:	73
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00EBB1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 00EBB208

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 1cf0409d4008bea6825051d62cc97ada12a80fce26241d19eb1a8388e5b06be6
Instruction ID: 9611852d52b131ebeec8643e4f3c8671c7b4e11448f83bc488cefdec100ed652
Opcode Fuzzy Hash: 1cf0409d4008bea6825051d62cc97ada12a80fce26241d19eb1a8388e5b06be6
Instruction Fuzzy Hash: 0301D1749042409FDB10CF15E9857AAFBE4EF05724F18C8AADD099F262D3B9E404CFA2

Function 00EBB246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00EBB2F3

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2440ea8e80dd7bbe3e5d7312d391a3fd02e12863d47a99a31c5ea62ebb9fc073
Instruction ID: 9c66a71166c9c3e7bc5a752e073d3a7ac117352f2556d7986b085bae78906477
Opcode Fuzzy Hash: 2440ea8e80dd7bbe3e5d7312d391a3fd02e12863d47a99a31c5ea62ebb9fc073
Instruction Fuzzy Hash: 2E31A371404344AFE7228B61CC45FA7BFFCEF06314F04849AE985CB162D365A919DB71

Function 00EBAD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00EBADA7

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1c2686f5281c10cc5da66975e86fcf0afecd65f6b6d228d711f5f81aa50ad7e9
Instruction ID: e73d4e02dcdd85c9d24e8113c2aff69d41fad925d177ac552a0329d51ecf6b8d
Opcode Fuzzy Hash: 1c2686f5281c10cc5da66975e86fcf0afecd65f6b6d228d711f5f81aa50ad7e9
Instruction Fuzzy Hash: 4031B571404344AFEB228B61CC45FA7BFACEF05218F08489AF985DB552D325E819DB71

Function 00EBAB76 Relevance: 1.6, APIs: 1, Instructions: 93
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 00EBAC36

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: b95c93b6ac9014a76af855bb05aee5e2b3ab9379f0d1b6525992ee3ebe712983
Instruction ID: 0129267a4cd82844f55a8697e8a4eab8348f4d5b4ce73531856efc828cfd449a
Opcode Fuzzy Hash: b95c93b6ac9014a76af855bb05aee5e2b3ab9379f0d1b6525992ee3ebe712983
Instruction Fuzzy Hash: 24316C7150E3C06FD3138B718C65A96BFB4AF47610F1A84DBD884DB1A3D229A919C7A2

Function 00EBA5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00EBA67D

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f3dd1360de91bc16d0843dcefa6f919b4f26bff1d8fbf83cedbc1ebe5e092d16
Instruction ID: cce4172018480226030e203320788c9286d1d8e832dd864b1779fe6f95259aff
Opcode Fuzzy Hash: f3dd1360de91bc16d0843dcefa6f919b4f26bff1d8fbf83cedbc1ebe5e092d16
Instruction Fuzzy Hash: 183170B1505340AFE721CF65CC45FA6BBE8EF09224F0884AEE9859B252D375E819CB71

Function 00EBA120 Relevance: 1.6, APIs: 1, Instructions: 82
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00EBA1C2

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: cabb93c253731a9188d87d8353e2b9db3f2a63cd355ecf9583f07117791b0c87
Instruction ID: 843993ab9fef739adfef206f70321115ca1c139600f808bad97722a5e6a652a4
Opcode Fuzzy Hash: cabb93c253731a9188d87d8353e2b9db3f2a63cd355ecf9583f07117791b0c87
Instruction Fuzzy Hash: 7E21E27140D3C06FD3128B258C51BA6BFB4EF47620F1985CBE8848F293D339A919C7A2

Function 00EBA370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,FE5B78E6,00000000,00000000,00000000,00000000), ref: 00EBA40C

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c91db5c7dadf4a9848820de1fbdcd057b3477b6e1933f97c34e117ad8eb1384a
Instruction ID: b5a8a0cc894df4ed7b95030e092808cc749dab22e38546f3ccf8fd7b4e61624a
Opcode Fuzzy Hash: c91db5c7dadf4a9848820de1fbdcd057b3477b6e1933f97c34e117ad8eb1384a
Instruction Fuzzy Hash: AD216B75504740AFDB21CB11DC84FA7BBE8EF05614F0884AAE9859B252D364E948CBA2

Function 00EBB276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00EBB2F3

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7a94c86207dbf52687983562358469b7c4527eeb1f9af1f787f5178e84af7c83
Instruction ID: 81652f004ea54d614f31c507979fb326179036f121de03708bec56c6c4aeb1fe
Opcode Fuzzy Hash: 7a94c86207dbf52687983562358469b7c4527eeb1f9af1f787f5178e84af7c83
Instruction Fuzzy Hash: EE21C171500204AFEB219F65DC45FABBBECEF08328F04886AE945DB651D775E5048BA1

Function 00EBAD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00EBADA7

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 76a3d09b14fd8b52e426d9c9ba050e0a36eb21522f0915955e4403db2411d87b
Instruction ID: f029e476dfefa63e82df31e0c781852022734ea13707b376305a1ef5f5a8df35
Opcode Fuzzy Hash: 76a3d09b14fd8b52e426d9c9ba050e0a36eb21522f0915955e4403db2411d87b
Instruction Fuzzy Hash: 8421C471500204AFEB219F64CC45FABFBECEF04328F14886AF945DB551D735E4448BA1

Function 00EBA850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E24,FE5B78E6,00000000,00000000,00000000,00000000), ref: 00EBA8DE

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 186cc51ab3dc657b0ab609bfc443ba6a36c07ac063b433fb35727235fe775561
Instruction ID: 2a13da6dae5b489ae640b02e653fcf7f30d0feefb91eda4253d43136f75676e4
Opcode Fuzzy Hash: 186cc51ab3dc657b0ab609bfc443ba6a36c07ac063b433fb35727235fe775561
Instruction Fuzzy Hash: B821A7714093806FEB228F60DC44FA6BFB8EF46714F0984EAE9849B152D365A919C771

Function 00EBA933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,FE5B78E6,00000000,00000000,00000000,00000000), ref: 00EBA9C1

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 894db5e4e70b79f34231366e27391a3359cf473b241059d22fe47ef33e9cdc77
Instruction ID: 8c02760ff476a54d4cc931338cf4aa6018ac37ef83ed351163fbd46caaa54c2d
Opcode Fuzzy Hash: 894db5e4e70b79f34231366e27391a3359cf473b241059d22fe47ef33e9cdc77
Instruction Fuzzy Hash: 4C21A171409380AFDB228F61DC45F97BFB8EF46314F08849AE9849B152C365A448CBB2

Function 00EBA5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00EBA67D

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ef03dbdece1c4cad8499ffd29dba7eb0cb0b3e574bf2f3f89dfa2a8219fa4f1b
Instruction ID: 43e74755fa994f44a524b5bee67eea97af1967c57d820c977cdf8a4bccd58286
Opcode Fuzzy Hash: ef03dbdece1c4cad8499ffd29dba7eb0cb0b3e574bf2f3f89dfa2a8219fa4f1b
Instruction Fuzzy Hash: F52192B1504600AFEB21DF65CD85FA7FBE8EF08714F088869E9459B251E375E804CB72

Function 00EBA78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,FE5B78E6,00000000,00000000,00000000,00000000), ref: 00EBA815

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: a338b0b012ac8eb36bdbed1b1ee4786c61a6c8c92a1c492b3f08fc24f15c6f91
Instruction ID: ba40af4e97af34cfa8d6ef5dc216b155c7576c0640b7f72533a6cc8ea36a6ee9
Opcode Fuzzy Hash: a338b0b012ac8eb36bdbed1b1ee4786c61a6c8c92a1c492b3f08fc24f15c6f91
Instruction Fuzzy Hash: F021D8B54097806FE7128B21DC45BA6BFB8DF47318F0880DAE9848B153D368A909D7B6

Function 00EBAA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00EBAA8B

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 357205d5291faa40117282474dee7e132f3c424d8f21305da4eb2c1a819f34c7
Instruction ID: cdd81e016afcb6204f149900690b289c06e81fb240638f3af96f28638a9ecf9d
Opcode Fuzzy Hash: 357205d5291faa40117282474dee7e132f3c424d8f21305da4eb2c1a819f34c7
Instruction Fuzzy Hash: 71219D715092805FDB12CB29DC55B93BFE8AF06314F0D84EAE884CB253E225D909CB62

Function 00EBA392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,FE5B78E6,00000000,00000000,00000000,00000000), ref: 00EBA40C

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 463c59f8440ef0fe367410bf7239d140bf0c05a2b12751cfdfd5360f9d8582ff
Instruction ID: ac75838453ce7e6e6d2ed5b2b9a87e690b4f62afa447e9b44e3ffb515cf74899
Opcode Fuzzy Hash: 463c59f8440ef0fe367410bf7239d140bf0c05a2b12751cfdfd5360f9d8582ff
Instruction Fuzzy Hash: E521C075600600AFEB20CF25CC85FA7F7ECEF08718F08846AE945DB251D7A4E804CAB2

Function 00EBA962 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,FE5B78E6,00000000,00000000,00000000,00000000), ref: 00EBA9C1

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 57b6185e89206e825b22e05cf7b5d30c506c55faae081d9736ec6a6972fca6e8
Instruction ID: 857ab4746ef32b5f6ce76b311c3895421d75105f4b3d4d00e66aef1d81e515dc
Opcode Fuzzy Hash: 57b6185e89206e825b22e05cf7b5d30c506c55faae081d9736ec6a6972fca6e8
Instruction Fuzzy Hash: 86112B71400200AFDB21CF55DC41F97F7E8EF44728F18846AE9459B151C335E444DBB2

Function 00EBA882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E24,FE5B78E6,00000000,00000000,00000000,00000000), ref: 00EBA8DE

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: dd58e579ebb7d38da264aea5d6a60ddeba8378cefc6a5ec70239c6859d0307bc
Instruction ID: 3150946e797f8995304daee404d4cbafce27993a50d3c9872156d1412634acca
Opcode Fuzzy Hash: dd58e579ebb7d38da264aea5d6a60ddeba8378cefc6a5ec70239c6859d0307bc
Instruction Fuzzy Hash: 4811C471504200AFEB21CF54DC85BA7F7E8EF44728F18886AE9459B241D375E5049BB2

Function 00EBA2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00EBA30C

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 9cb448b07210b05aacc203a569cc3d38834afe96dd059b78a0c8e3701b1175f3
Instruction ID: 2caa9196cdc9128cc526b132c328763b9af6d01ccb14041056b59ce9b39e9732
Opcode Fuzzy Hash: 9cb448b07210b05aacc203a569cc3d38834afe96dd059b78a0c8e3701b1175f3
Instruction Fuzzy Hash: 4B1191754097C09FDB228B25DC54A96BFB4DF17224F0D80DBE9858F263D265A809CB62

Function 00EBA7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,FE5B78E6,00000000,00000000,00000000,00000000), ref: 00EBA815

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: ef5fb7ff53b9c8d1296173c80ab3e06e92753feca3edcc0352fd2f7b04fd5fe4
Instruction ID: 3bf469466a7a31bea411e88ce227ec72fbd4706b93197d28e2b26a849aba736e
Opcode Fuzzy Hash: ef5fb7ff53b9c8d1296173c80ab3e06e92753feca3edcc0352fd2f7b04fd5fe4
Instruction Fuzzy Hash: F201D675504200AEEB20CB15DC85FA7F7D8DF04728F18C46AEE059B651D778E9448AB6

Function 00EBAA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00EBAA8B

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 827906a7bdeee1a5fdc15afe1da23d2a81b37d4cb7077bc2aac565d4ba1ac29c
Instruction ID: 5d47e9c354bf2b93a52894aff609c37187ba7e2a1e570ab38119db08100006a5
Opcode Fuzzy Hash: 827906a7bdeee1a5fdc15afe1da23d2a81b37d4cb7077bc2aac565d4ba1ac29c
Instruction Fuzzy Hash: EC118E716042409FEB10CF29D985BA7BBD8EF04724F0CC4AAED09DB242E335E804CA72

Function 00EBB1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 00EBB208

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: a8600c848f81a7c73bfac6b08f574f1147e792908ed0c3c306cc30b7812c82c1
Instruction ID: f813aa9b5388663c5dbff7696385531fef4eb135fb30c66154a8ebe2b928cad6
Opcode Fuzzy Hash: a8600c848f81a7c73bfac6b08f574f1147e792908ed0c3c306cc30b7812c82c1
Instruction Fuzzy Hash: D41170714093C09FDB128F15DD84B56BFA4DF56224F0884EAED859F263D275A908CB62

Function 00EBAF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00EBAFE4

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 6d2fb387deb0e0d90bf5e64cbef9540461ae5f25b9255df59399376a8f439985
Instruction ID: ab7eb664d38585c762c7e447d757f69551d34d262b3205d33ea55c367e9848d2
Opcode Fuzzy Hash: 6d2fb387deb0e0d90bf5e64cbef9540461ae5f25b9255df59399376a8f439985
Instruction Fuzzy Hash: 9C11A3715097C09FD7128B25DC45A53BFF4EF06220F0984EAED858B263D374A808DB61

Function 00EBABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 00EBAC36

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 89e0944cb0883edb80f89a816c457bbf54fcda61ccc5cabb1d743a56729f84fb
Instruction ID: 80203e345fd8bd01269822f9ad26585321da5ad245dbcecc8328e32651ed5c3c
Opcode Fuzzy Hash: 89e0944cb0883edb80f89a816c457bbf54fcda61ccc5cabb1d743a56729f84fb
Instruction Fuzzy Hash: 1801B171A00200ABD310DF16CC86B26FBE8FB88B24F24811AEC089B741D735F915CBE1

Function 00EBA172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00EBA1C2

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 15629811910ff36a7ff0bd7d2a1f993e87526211b2603ca27fad024662b8024a
Instruction ID: 2cea448c92e39a74ae4fefe2e3b9142371c51fce196ae16af79108f22948147a
Opcode Fuzzy Hash: 15629811910ff36a7ff0bd7d2a1f993e87526211b2603ca27fad024662b8024a
Instruction Fuzzy Hash: CA01B171A00200ABD310DF16CC86B26FBE8EB88A24F24815AEC089B741D735F911CBE1

Function 00EBAFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00EBAFE4

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: f11a636cddf1fe452329f3bad62bd657f85a1c4c399d31c451d3e1f9612a5f9f
Instruction ID: cf27c448aebed2f46851741a2a5cf81238d3fdc2df39e08420280a4707672356
Opcode Fuzzy Hash: f11a636cddf1fe452329f3bad62bd657f85a1c4c399d31c451d3e1f9612a5f9f
Instruction Fuzzy Hash: D501D1B4604640DFDB109F19D8857A3FBD4EF04324F08C4AAED499B352D379E844DEA2

Function 00EBA2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00EBA30C

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c8685a306c3ec81f5a498ffbdccabcc08d8d032f43de7a99fad89320cc008208
Instruction ID: e04cfc11bfcaaccf6fb63fe84d709e8a4bdac21d8f630ee481148d888ffd6ace
Opcode Fuzzy Hash: c8685a306c3ec81f5a498ffbdccabcc08d8d032f43de7a99fad89320cc008208
Instruction Fuzzy Hash: 53F08C74904640DFDB209F15D9857A6FBE0EF04724F18C4AADD095B252D379A848CAA2

Function 01410C99 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

[MT, xrefs: 01410D43, 01410D48

Memory Dump Source

Source File: 0000000F.00000002.1961178980.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1410000_unarchiver.jbxd

Similarity

API ID:
String ID: [MT
API String ID: 0-1650943106
Opcode ID: b0ebdf27e8fcd5c3956eac38d869fc2d63e3e34a29d494759b1716d3685133d6
Instruction ID: a52cf9d093a73b66025668c61dc60de2e6e20082eb6b6ead3ca4d3b690fa5688
Opcode Fuzzy Hash: b0ebdf27e8fcd5c3956eac38d869fc2d63e3e34a29d494759b1716d3685133d6
Instruction Fuzzy Hash: BE2135707002548FCB14EB3984547AE7BD29FC5204F85483DE146EB392DF7AD9078792

Function 01410CA8 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

[MT, xrefs: 01410D43, 01410D48

Memory Dump Source

Source File: 0000000F.00000002.1961178980.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1410000_unarchiver.jbxd

Similarity

API ID:
String ID: [MT
API String ID: 0-1650943106
Opcode ID: c362f9883262eae476623870a6197779bd651ed6fc2f3efe7ffb51e782cd6aee
Instruction ID: dc8091ebaf0f43edcd00bba9ee2a97256ab490a995753cf6e006b90aba460f26
Opcode Fuzzy Hash: c362f9883262eae476623870a6197779bd651ed6fc2f3efe7ffb51e782cd6aee
Instruction Fuzzy Hash: C021F3707003088BC714EB39C5556AFB7D69FC5204B85883DE146EB386DF7AE9068792

Function 00EBA6D4 Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 00EBA748

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d23846470e213e4215a146e34c6d3cd302aa3b2fd0b669546f33880c845aa15c
Instruction ID: 673095b1da73e6b1392c3c56e5f14c79e97ccbf01d85d3617424b173db1151f6
Opcode Fuzzy Hash: d23846470e213e4215a146e34c6d3cd302aa3b2fd0b669546f33880c845aa15c
Instruction Fuzzy Hash: 9321B3B55097C05FDB128F25DC95692BFB8EF07324F0984DBEC858F2A3D2649908C762

Function 00EBA716 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 00EBA748

Memory Dump Source

Source File: 0000000F.00000002.1960471955.0000000000EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eba000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 574d5d525f662caaa181add665b20ba8b1c4fb17a00e079f8442294a49f23824
Instruction ID: 9dc1cb49d46934141057c42f9ff4841a9f9bdc1d0b15bb86096425c4f7b57c14
Opcode Fuzzy Hash: 574d5d525f662caaa181add665b20ba8b1c4fb17a00e079f8442294a49f23824
Instruction Fuzzy Hash: 8101DF749082408FDB108F29D9857A6FBE4DF00324F18C4BBDC098B252D779E804CAA2

Function 014102C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1961178980.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1410000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa99fefd95a5cdb9271c7ae17a7490c1e959cd5c9d662419a27b00044d52f20
Instruction ID: 5755f88fc8dc955adcfef7bb3503a95a1e7648dcb4c965838fb1540ef9f35849
Opcode Fuzzy Hash: dfa99fefd95a5cdb9271c7ae17a7490c1e959cd5c9d662419a27b00044d52f20
Instruction Fuzzy Hash: A3B14E39600218EFC718EB79E869A5E7BF2FFA8240B508835F90697379DB319D41CB51

Function 01410798 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1961178980.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1410000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5b3856ea29ca674aa6941328248ebb5ea61cb258cee389313e8b9ebf44347b
Instruction ID: b82db71ee865d78d0bf5a737738318a1439caf70682a334a129a44e1f605a091
Opcode Fuzzy Hash: 5c5b3856ea29ca674aa6941328248ebb5ea61cb258cee389313e8b9ebf44347b
Instruction Fuzzy Hash: CCA15C38B002049FDB05AB79D46576E77B2AFD8308F158439E906A73A9DF39CD42CB52

Function 01410BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1961178980.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1410000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b713a57b6ad736cf7515db6b961dd99070b4799d75680e0398aeb37b677bae9
Instruction ID: 87264a4cf08be343cd19a92d99246a4e69d110932a7b5198c7ae69bdd6e044c8
Opcode Fuzzy Hash: 0b713a57b6ad736cf7515db6b961dd99070b4799d75680e0398aeb37b677bae9
Instruction Fuzzy Hash: FB11C135A10218AFCB04ABB4D85899E77F6FF88214B464435E205E7275EF30E8058B82

Function 00EE0808 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1960569837.0000000000EE0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_ee0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a4526ffa67f3c9b02d1d9f0b3b888e674b284e6c17dd36edf96de83943d7fe
Instruction ID: aff6bc981ad82c13de54b27baf5e100d4eeab534b72e03a3617db526542ffc7c
Opcode Fuzzy Hash: 17a4526ffa67f3c9b02d1d9f0b3b888e674b284e6c17dd36edf96de83943d7fe
Instruction Fuzzy Hash: 0501A7F69097406FD3018B55EC41C57BBECDF85524F15C4ABFC488B202E225E9088BF2

Function 00EE05E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1960569837.0000000000EE0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_ee0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51e2e071dad498e31851dc8a195a079ad9295572bc3f3e0341521b94d2b6dd4
Instruction ID: 91a9b6409794fb9f4794cd380b2961784212483778d39f5c74f4f25da2d7967f
Opcode Fuzzy Hash: c51e2e071dad498e31851dc8a195a079ad9295572bc3f3e0341521b94d2b6dd4
Instruction Fuzzy Hash: FFF0A9B65093845FD7118F05EC41863FFE8EA86630709C4AFEC498B652D269A909C772

Function 00EE082E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1960569837.0000000000EE0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_ee0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039c2c0116fef0ab57f54f3358865ea45fcef40f19048e54a67e182d1e8b7cb3
Instruction ID: ef35f464b0feb5df9ca7f7dfa8042fccc534b3c0b3aa88a36808ffe8b187c8d1
Opcode Fuzzy Hash: 039c2c0116fef0ab57f54f3358865ea45fcef40f19048e54a67e182d1e8b7cb3
Instruction Fuzzy Hash: 92F0A7B2909604AFD200DF55ED46856F7ECDF84525F14C57EEC088B301E376B9158AF2

Function 01410C50 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1961178980.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1410000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80408fcaac79853186a6148b7bcd9e763c09678bea3490c28453000ed5ca496
Instruction ID: 42fb140655ebcc3fb28cbc8279772f57bcb0f7d11f19ab00843cdab1846d3b1b
Opcode Fuzzy Hash: a80408fcaac79853186a6148b7bcd9e763c09678bea3490c28453000ed5ca496
Instruction Fuzzy Hash: 45E0D831F193541FCB04DAB8485459E7FB5DB85060B9545B9C104E7352EE3688038381

Function 00EE0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1960569837.0000000000EE0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_ee0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784804cd07393d994d49db97c9bfab07c9ac775a120d21c5e4c991708216eac9
Instruction ID: 8b87874189592ea716e974409ac05e98962e8335b00f8bc74f1af836fa9d09aa
Opcode Fuzzy Hash: 784804cd07393d994d49db97c9bfab07c9ac775a120d21c5e4c991708216eac9
Instruction Fuzzy Hash: 3AE092B6A046008BD650CF0AEC41452F7D8EB84630B18C47FDC0D8B711D239B504CAA5

Function 01410C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1961178980.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1410000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4310a5bf78687cabae4dbf45064d09cf827274841f1b16cccc04b06d5eeaeb08
Instruction ID: 31d4bca317bd4c8df01a35b575ff9ceb0b3f2545e20bfd6f0f96ba18eb7cd172
Opcode Fuzzy Hash: 4310a5bf78687cabae4dbf45064d09cf827274841f1b16cccc04b06d5eeaeb08
Instruction Fuzzy Hash: 24D0C231F003182B8B44EAB9480459F7BFA9B84054B854079D108D3301EE31D80183C0

Function 01410DD1 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1961178980.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1410000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115f7d2d0d9aa4a8f31e2426af2c2fe90f904bdc2a53920bedc5a43a452e0c18
Instruction ID: 2c582f0a4b5a7dc13806a6d68633f3734b49a0fd8fbf55fd5b42522f42b9391e
Opcode Fuzzy Hash: 115f7d2d0d9aa4a8f31e2426af2c2fe90f904bdc2a53920bedc5a43a452e0c18
Instruction Fuzzy Hash: C4E0C2302493808FCB02D77D88249997F715FE1114F8A83BBE449CBABBC639C886CB41

Function 00EB23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1960451827.0000000000EB2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eb2000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34cf60778d5716e55da34accbefa2a1dcdea4df76daba03dc630b34eed614142
Instruction ID: d532cddb6a1ca629312fc81a5d22ca975618d078d7c6a8693f2092084604dd32
Opcode Fuzzy Hash: 34cf60778d5716e55da34accbefa2a1dcdea4df76daba03dc630b34eed614142
Instruction Fuzzy Hash: F6D05E792056814FD3169E1CC5A5BD63BD8AF51719F4A44FDA800CBB63C768D981E600

Function 00EB23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1960451827.0000000000EB2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_eb2000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18a85d42049534183af4401a75056b7a51fed3448f27610bcc780ab2db86fe93
Instruction ID: 1a2ca4aa25d2ca39a771075a902cbd26415581b402066aaffaeda10e43cd2346
Opcode Fuzzy Hash: 18a85d42049534183af4401a75056b7a51fed3448f27610bcc780ab2db86fe93
Instruction Fuzzy Hash: DDD05E342002828FCB15DE1CD6D4F9A33D8AF44718F1A44ECAC109B262C7A8D8C1DA00

Function 01410DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1961178980.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1410000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a525bed9e1dc622ca39fccd6b186024ad0f19a8d8cc956abdda9ac9cc6aafc
Instruction ID: f70aeb4443a08ead4f74173ffb09755efe8d59577d004a8fb06592a7cae6dd3c
Opcode Fuzzy Hash: 46a525bed9e1dc622ca39fccd6b186024ad0f19a8d8cc956abdda9ac9cc6aafc
Instruction Fuzzy Hash: D4C012303003088BD704A769D418A2677966BE0214F85C075F5080B36ACB70E880C680

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 37429345.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7949dccb-9dc0-46ce-9bb1-e825e679125d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241028172903Z-177.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Temp\MSI5204e.LOG

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91evobgb_1s86il7_4cg.tmp

Windows Analysis Report
37429345.pdf