Analysis Report https://templatelab.com/ada-rehabilitaion-act-coronavirus/

Overview

General Information

Sample URL: https://templatelab.com/ada-rehabilitaion-act-coronavirus/
Analysis ID: 357038
Infos:

Most interesting Screenshot:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Compliance:

barindex
Uses new MSVCR Dlls
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Uses secure TLS version for HTTPS connections
Source: unknown HTTPS traffic detected: 104.26.12.36:443 -> 192.168.2.3:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.36:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x3e1a6b76,0x01d70a98</date><accdate>0x3e1a6b76,0x01d70a98</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x3e1a6b76,0x01d70a98</date><accdate>0x3e1ccdbb,0x01d70a98</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x3e2b1c0a,0x01d70a98</date><accdate>0x3e2b1c0a,0x01d70a98</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x3e2b1c0a,0x01d70a98</date><accdate>0x3e2b1c0a,0x01d70a98</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x3e34a537,0x01d70a98</date><accdate>0x3e34a537,0x01d70a98</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x3e34a537,0x01d70a98</date><accdate>0x3e37078a,0x01d70a98</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: templatelab.com
Source: AcroRd32.exe, 00000006.00000003.239652748.000000000BF43000.00000004.00000001.sdmp String found in binary or memory: http://w.a
Source: msapplication.xml.1.dr String found in binary or memory: http://www.amazon.com/
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp, AcroRd32.exe, 00000006.00000003.267703684.000000000BBC4000.00000004.00000001.sdmp String found in binary or memory: http://www.askjan.org/
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: http://www.askjan.org/)
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp String found in binary or memory: http://www.askjan.org/xm
Source: msapplication.xml1.1.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr String found in binary or memory: http://www.nytimes.com/
Source: AcroRd32.exe, 00000006.00000002.1651921116.00000000074B0000.00000002.00000001.sdmp String found in binary or memory: http://www.quicktime.com.Acrobat
Source: msapplication.xml4.1.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr String found in binary or memory: http://www.youtube.com/
Source: AcroRd32.exe, 00000006.00000003.274224374.000000000B9CD000.00000004.00000001.sdmp String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/
Source: AcroRd32.exe, 00000006.00000003.274224374.000000000B9CD000.00000004.00000001.sdmp String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/)m
Source: AcroRd32.exe, 00000006.00000003.274224374.000000000B9CD000.00000004.00000001.sdmp String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/9l
Source: AcroRd32.exe, 00000006.00000003.267703684.000000000BBC4000.00000004.00000001.sdmp String found in binary or memory: https://askjan.org/topics/COVID-19.cfm
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://askjan.org/topics/COVID-19.cfm)
Source: AcroRd32.exe, 00000006.00000003.267703684.000000000BBC4000.00000004.00000001.sdmp String found in binary or memory: https://askjan.org/topics/COVID-19.cfm2.
Source: AcroRd32.exe, 00000006.00000002.1650541564.0000000005360000.00000002.00000001.sdmp, ~DF607C8DFA7F9E2A87.TMP.1.dr String found in binary or memory: https://templatelab.com/ada-rehabilitaion-act-coronavirus/
Source: {679099D5-768B-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://templatelab.com/ada-rehabilitaion-act-coronavirus/Root
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/community/contact-tracing-nonhealthcare-workplaces.html)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/community/critical-workers/implementing-safety-practices.h
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/community/general-business-faq.html)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/community/high-risk-workers.html?deliveryName=USCDC_2067-D
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/community/index.html)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/community/organizations/businesses-employers.html)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/community/organizations/testing-non-healthcare-workplaces.
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/downloads/Essential-Critical-Workers_Dos-and-Donts.pdf)
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/lab/resources/antibody-tests-guidelines.html
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/lab/resources/antibody-tests-guidelines.html#
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/lab/resources/antibody-tests-guidelines.html)
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/lab/resources/antibody-tests-guidelines.html/
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/people-at-higher-risk.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/people-at-higher-risk.html)
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/pregnancy-breastfeeding.html
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/pregnancy-breastfeeding.html&
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/pregnancy-breastfeeding.html)
Source: AcroRd32.exe, 00000006.00000003.278360966.000000000BB75000.00000004.00000001.sdmp String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/symptoms-testing/symptoms.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/symptoms-testing/symptoms.html)
Source: AcroRd32.exe, 00000006.00000003.278360966.000000000BB75000.00000004.00000001.sdmp String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/vaccines/different-vaccines/mrna.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/vaccines/different-vaccines/mrna.html)
Source: AcroRd32.exe, 00000006.00000003.236561521.0000000009B28000.00000004.00000001.sdmp, ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.ecfr.gov/cgi-bin/text-idx?SID=28cadc4b7b37847fd37f41f8574b5921&mc=true&node=pt29.4.1630&
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/chart-risk-factors-harassment-and-responsive-strategies)
Source: AcroRd32.exe, 00000006.00000003.274224374.000000000B9CD000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/coronavirus
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/coronavirus)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/disability-discrimination)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/employers/small-business/harassment-policy-tips)
Source: AcroRd32.exe, 00000006.00000003.236561521.0000000009B28000.00000004.00000001.sdmp, ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/enforcement-guidance-disability-related-inquiries-and-medical-exa
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/enforcement-guidance-reasonable-accommodation-and-undue-hardship-
Source: AcroRd32.exe, 00000006.00000003.236561521.0000000009B28000.00000004.00000001.sdmp, ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/enforcement-guidance-unlawful-disparate-treatment-workers-caregiv
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/laws/guidance/legal-rights-pregnant-workers-under-federal-law
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/legal-rights-pregnant-workers-under-federal-law)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q1
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q5
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q6
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q7
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#se
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/qa-understanding-waivers-discrimination-claims-employee-severance
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/laws/guidance/questions-and-answers-religious-discrimination-workplace
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/laws/guidance/questions-and-answers-religious-discrimination-workplace)
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/laws/guidance/questions-and-answers-religious-discrimination-workplaceJ
Source: AcroRd32.exe, 00000006.00000003.279519878.000000000B549000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/laws/guidance/questions-and-answers-religious-discrimination-workplace_
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/select-task-force-study-harassment-workplace#_Toc453686319)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/sites/default/files/2020-04/pandemic_flu.pdf)
Source: AcroRd32.exe, 00000006.00000003.278360966.000000000BB75000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q1
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q1)
Source: AcroRd32.exe, 00000006.00000003.278360966.000000000BB75000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q17
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q17)
Source: AcroRd32.exe, 00000006.00000003.278360966.000000000BB75000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q18=
Source: AcroRd32.exe, 00000006.00000003.278360966.000000000BB75000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q1~=5
Source: AcroRd32.exe, 00000006.00000003.278360966.000000000BB75000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q20
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q20)
Source: AcroRd32.exe, 00000006.00000003.278360966.000000000BB75000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q9
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q9)
Source: AcroRd32.exe, 00000006.00000003.278360966.000000000BB75000.00000004.00000001.sdmp String found in binary or memory: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q9L
Source: AcroRd32.exe, 00000006.00000003.236561521.0000000009B28000.00000004.00000001.sdmp, ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.eeoc.gov/wysk/message-eeoc-chair-janet-dhillon-national-origin-and-race-discrimination-d
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.fda.gov/medical-devices/emergency-situations-medical-devices/faqs-diagnostic-testing-sar
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.fda.gov/vaccines-blood-biologics/vaccines/emergency-use-authorization-vaccines-explained
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.govinfo.gov/content/pkg/CFR-2011-title29-vol4/xml/CFR-2011-title29-vol4-sec1630-10.xml)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.govinfo.gov/content/pkg/CFR-2012-title29-vol4/xml/CFR-2012-title29-vol4-sec1630-2.xml)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.govinfo.gov/content/pkg/CFR-2019-title29-vol4/xml/CFR-2019-title29-vol4-sec1630-14.xml)
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.govinfo.gov/content/pkg/USCODE-2018-title42/html/USCODE-2018-title42-chap126-subchapI-se
Source: AcroRd32.exe, 00000006.00000003.267703684.000000000BBC4000.00000004.00000001.sdmp String found in binary or memory: https://www.osha.gov/SLTC/covid-19/
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr String found in binary or memory: https://www.osha.gov/SLTC/covid-19/)
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown HTTPS traffic detected: 104.26.12.36:443 -> 192.168.2.3:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.36:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: classification engine Classification label: clean0.win@17/61@1/3
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/enforcement-guidance-reasonable-accommodation-and-undue-hardship-under-ada#general
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/select-task-force-study-harassment-workplace#_Toc453686319
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/disability-discrimination
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.osha.gov/SLTC/covid-19/
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q1
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/legal-rights-pregnant-workers-under-federal-law
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/sites/default/files/2020-04/pandemic_flu.pdf
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/community/critical-workers/implementing-safety-practices.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: http://www.askjan.org/
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/pregnancy-breastfeeding.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q9
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/community/organizations/businesses-employers.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/lab/resources/antibody-tests-guidelines.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.ecfr.gov/cgi-bin/text-idx?sid=28cadc4b7b37847fd37f41f8574b5921&mc=true&node=pt29.4.1630&rgn=div5#se29.4.1630_12
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.govinfo.gov/content/pkg/cfr-2012-title29-vol4/xml/cfr-2012-title29-vol4-sec1630-2.xml
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q7
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/vaccines/different-vaccines/mrna.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/downloads/essential-critical-workers_dos-and-donts.pdf
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.govinfo.gov/content/pkg/CFR-2019-title29-vol4/xml/CFR-2019-title29-vol4-sec1630-14.xml
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/enforcement-guidance-reasonable-accommodation-and-undue-hardship-under-ada#requesting
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/people-at-higher-risk.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://askjan.org/topics/COVID-19.cfm
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.fda.gov/medical-devices/emergency-situations-medical-devices/faqs-diagnostic-testing-sars-cov-2
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.osha.gov/sltc/covid-19/
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/community/index.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/wysk/message-eeoc-chair-janet-dhillon-national-origin-and-race-discrimination-during-covid-19
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#secB
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://askjan.org/topics/covid-19.cfm
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/community/contact-tracing-nonhealthcare-workplaces.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/community/high-risk-workers.html?deliveryName=USCDC_2067-DM29601
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/enforcement-guidance-unlawful-disparate-treatment-workers-caregiving-responsibilities
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/employers/small-business/harassment-policy-tips
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.govinfo.gov/content/pkg/CFR-2012-title29-vol4/xml/CFR-2012-title29-vol4-sec1630-2.xml
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/enforcement-guidance-reasonable-accommodation-and-undue-hardship-under-ada#undue
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/select-task-force-study-harassment-workplace#_toc453686319
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.govinfo.gov/content/pkg/cfr-2011-title29-vol4/xml/cfr-2011-title29-vol4-sec1630-10.xml
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/community/high-risk-workers.html?deliveryname=uscdc_2067-dm29601
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q20
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/community/organizations/testing-non-healthcare-workplaces.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.govinfo.gov/content/pkg/USCODE-2018-title42/html/USCODE-2018-title42-chap126-subchapI-sec12112.htm
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/community/general-business-faq.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/symptoms-testing/symptoms.html
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#secb
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/coronavirus
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/chart-risk-factors-harassment-and-responsive-strategies
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.govinfo.gov/content/pkg/CFR-2011-title29-vol4/xml/CFR-2011-title29-vol4-sec1630-10.xml
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/questions-and-answers-religious-discrimination-workplace
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q6
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q11
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q5
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.cdc.gov/coronavirus/2019-ncov/downloads/Essential-Critical-Workers_Dos-and-Donts.pdf
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.ecfr.gov/cgi-bin/text-idx?SID=28cadc4b7b37847fd37f41f8574b5921&mc=true&node=pt29.4.1630&rgn=div5#se29.4.1630_12
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q12
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.govinfo.gov/content/pkg/cfr-2019-title29-vol4/xml/cfr-2019-title29-vol4-sec1630-14.xml
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/enforcement-guidance-disability-related-inquiries-and-medical-examinations-employees
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q17
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q16
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q19
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q18
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/transcript-march-27-2020-outreach-webinar#q17
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.fda.gov/vaccines-blood-biologics/vaccines/emergency-use-authorization-vaccines-explained
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.govinfo.gov/content/pkg/uscode-2018-title42/html/uscode-2018-title42-chap126-subchapi-sec12112.htm
Source: ._files_ada-rehabilitaion-act-coronavirus.pdf[1].pdf.2.dr Initial sample: https://www.eeoc.gov/laws/guidance/qa-understanding-waivers-discrimination-claims-employee-severance-agreements
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFDA36E2CF24B83655.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4600 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' /o /eo /l /b /ac /id 2024
Source: unknown Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 /o /eo /l /b /ac /id 2024
Source: unknown Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043
Source: unknown Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1700,14431000459877472766,9177081831552403983,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=9047234563143899772 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2
Source: unknown Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1700,14431000459877472766,9177081831552403983,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=13126402487251577759 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13126402487251577759 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
Source: unknown Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1700,14431000459877472766,9177081831552403983,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=13365710013370324663 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13365710013370324663 --renderer-client-id=4 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job /prefetch:1
Source: unknown Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1700,14431000459877472766,9177081831552403983,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=15977986577334180066 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15977986577334180066 --renderer-client-id=5 --mojo-platform-channel-handle=2164 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4600 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' /o /eo /l /b /ac /id 2024 Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 /o /eo /l /b /ac /id 2024 Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043 Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1700,14431000459877472766,9177081831552403983,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=9047234563143899772 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1700,14431000459877472766,9177081831552403983,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=13126402487251577759 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13126402487251577759 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1 Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1700,14431000459877472766,9177081831552403983,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=13365710013370324663 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13365710013370324663 --renderer-client-id=4 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job /prefetch:1 Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1700,14431000459877472766,9177081831552403983,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=15977986577334180066 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15977986577334180066 --renderer-client-id=5 --mojo-platform-channel-handle=2164 --allow-no-sandbox-job /prefetch:1 Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe File opened: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\crash_reporter.cfg Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe File opened: C:\Windows\SysWOW64\Msftedit.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: AcroRd32.exe, 00000006.00000003.279580368.000000000BD4A000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Code function: 6_2_04943490 LdrInitializeThunk, 6_2_04943490
Source: AcroRd32.exe, 00000006.00000002.1650541564.0000000005360000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: AcroRd32.exe, 00000006.00000002.1650541564.0000000005360000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: AcroRd32.exe, 00000006.00000002.1650541564.0000000005360000.00000002.00000001.sdmp Binary or memory string: Progman
Source: AcroRd32.exe, 00000006.00000002.1650541564.0000000005360000.00000002.00000001.sdmp Binary or memory string: Progmanlock
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 357038 URL: https://templatelab.com/ada... Startdate: 24/02/2021 Architecture: WINDOWS Score: 0 8 iexplore.exe 2 86 2->8         started        process3 10 iexplore.exe 31 8->10         started        dnsIp4 31 templatelab.com 104.26.12.36, 443, 49708, 49709 CLOUDFLARENETUS United States 10->31 13 AcroRd32.exe 35 10->13         started        process5 process6 15 RdrCEF.exe 52 13->15         started        18 AcroRd32.exe 3 5 13->18         started        dnsIp7 33 192.168.2.1 unknown unknown 15->33 20 RdrCEF.exe 15->20         started        23 RdrCEF.exe 15->23         started        25 RdrCEF.exe 15->25         started        27 RdrCEF.exe 15->27         started        process8 dnsIp9 29 80.0.0.0 NTLGB United Kingdom 20->29
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.26.12.36
 unknown United States
13335 CLOUDFLARENETUS false
80.0.0.0
 unknown United Kingdom
5089 NTLGB false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
templatelab.com 104.26.12.36 true