Edit tour

Windows Analysis Report
Cancellation_418406_Dec23.pdf

Overview

General Information

Sample Name:	Cancellation_418406_Dec23.pdf
Analysis ID:	778232
MD5:	c085bbddc02251986f1fd8b84c5a404e
SHA1:	98d3377ff32441e24baa96f1d0fd83190e274c22
SHA256:	ca2d98108f12fb407cb0e1778febc9ff453ebbd8888e3b184cb8b9993775b5d8
Infos:

Detection

Qbot Downloader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found potential malicious PDF (bad image similarity)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Yara detected Qbot Downloader

Clickable URLs found in PDF pointing to potentially malicious files

Creates a DirectInput object (often for capturing keystrokes)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

AcroRd32.exe (PID: 2156 cmdline: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Cancellation_418406_Dec23.pdf MD5: B969CF0C7B2C443A99034881E8C8740A)

RdrCEF.exe (PID: 5448 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 9AEBA3BACD721484391D15478A4080C7)

chrome.exe (PID: 7152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 2364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1812,i,544507481073856773,15156316211615148029,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

unarchiver.exe (PID: 6076 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 5296 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 5312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: Qbot Downloader

{"Download Url": "http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Cancellation_418406_Dec23.pdf	JoeSecurity_QbotDownloader	Yara detected Qbot Downloader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip

Virustotal: Detection: 15%

Perma Link

Source: Cancellation_418406_Dec23.pdf

Malware Configuration Extractor: Qbot Downloader {"Download Url": "http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip"}

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Spreading

Yara detected Qbot Downloader

Source: Yara match

File source: Cancellation_418406_Dec23.pdf, type: SAMPLE

Source: Joe Sandbox View

ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 05 Jan 2023 08:03:45 GMTServer: ApacheX-Powered-By: PHP/8.1.13Connection: keep-alive, Keep-AliveAccept-Ranges: bytesExpires: 0Cache-Control: no-cache, no-store, must-revalidateContent-Disposition: attachment; filename="Cancellation_367461_Dec23.zip"Upgrade: h2,h2cConnection: UpgradeContent-Length: 801520Vary: Accept-EncodingKeep-Alive: timeout=5Content-Type: application/zipData Raw: 50 4b 03 04 14 00 01 00 08 00 02 9c 97 55 e0 d4 f8 ae 42 3a 0c 00 00 d0 6a 06 14 00 00 00 43 61 6e 63 65 6c 6c 61 74 69 6f 6e 23 4a 35 38 2e 69 73 6f 79 61 b4 0c 99 42 96 64 6f 83 91 a6 87 9a e5 3b a7 9b fa 5c ce db 83 0b 04 d9 b6 6c 6b c0 29 f7 77 06 99 5d 89 d8 25 f7 83 d0 e7 99 b5 61 ec 80 11 0d 3f ab ff b3 1e 8a da 89 07 00 17 6a ec e6 29 66 86 ed bf 05 74 c7 c4 7c 06 90 e2 b0 2d 93 97 cf c9 70 ab d3 95 5b b2 ed 34 37 cb cb 9b c8 3a fb be 6c 97 18 a2 80 38 1b 2f 9a 5a 49 9d 4c 08 51 38 eb d6 d9 76 b8 dd 45 e0 a7 da c5 f3 68 1d 93 e1 36 73 17 47 c3 84 d1 50 b0 20 e0 0f 2f 1c ba ad 94 8c d5 01 a0 44 c8 57 38 0e b7 40 e6 67 9d e3 e4 b7 ef 2d a6 da d8 4d ff be 7d a9 a8 68 55 a3 aa 40 fb 32 c8 a1 2b 79 c1 e4 f5 44 28 a9 e8 6d 90 d7 2c f8 a6 a7 d3 f7 4d cd 5c 12 87 6b 1c a6 df da 6c f4 db 85 6c 02 12 db 8a f5 b8 f3 5a 1e 09 34 9b f1 09 d4 31 61 ec dd 98 ce d0 fe 90 73 1d 8f ff 0f 0a 49 41 25 be 0a 11 13 3c 09 76 9f c6 c9 0c b8 42 55 a2 ef 6e 61 a6 e8 c0 f4 02 5a 7e fd c2 2f 48 3e 80 50 95 ce 2e f5 5a 93 67 db cd b2 29 e5 bb 9d 0e 62 e2 2c 31 ec 3a 10 92 44 3f 90 c3 4d 8d 78 1d 46 c1 7e f6 97 5a 08 bd 77 25 72 27 e9 80 65 ae d6 7a 71 36 ea b4 32 04 2e c4 39 00 76 fb 72 d4 40 ac 61 a6 37 85 ca f3 1f 0b a9 1c 0b 68 b6 46 50 87 c1 02 a6 5b 2c 19 53 aa 37 4e c9 91 6a 4f fa 5a 49 aa 28 55 28 fd 13 fb 29 bf 51 74 1d 23 18 cd 17 74 20 81 cf a2 6e 45 2e e2 71 c9 01 18 59 6f e6 8c 3c 09 1d 71 f9 92 87 c1 71 d9 40 fd e3 16 28 8a 86 ff 37 d4 e6 37 21 18 c0 7a 7f 44 37 e6 8d 17 12 6b 93 fb a5 8d 64 de 6d a5 1b fd 57 d9 4e 7d e0 56 b6 c1 76 c0 30 44 73 e9 a2 7f 4c 05 21 0a 60 55 17 f4 b7 da 7d ef 80 22 eb f8 df f2 e7 c0 f3 e9 96 5c 9a 67 ea 0a 27 b1 9a 56 9e 23 db 96 6d 10 a6 9b 6b e5 a2 e2 59 36 2b 26 9e 1b 69 9c d3 38 14 c6 36 f0 da 48 f3 79 40 c9 e2 7f dd 9d bf 3a 3a 05 47 80 07 34 e3 74 1e e4 0f 97 7b ae 19 c5 d9 68 9b df 3b 64 53 bf 69 af 0c bf 9c 9c 6a 36 18 67 ab 81 08 7b 42 6c 0d cd e1 62 60 11 a4 a7 21 23 a0 4f 6c 40 f5 7b 11 1d f0 76 5f 7a 8a 5b 2e 65 7f 21 1e 86 b6 19 54 57 b5 41 94 5b 90 8f 16 50 60 ae 7f a4 92 dc 2b a4 67 ad 6b 9b f2 05 9a 3a 94 ae 2a 89 78 68 9f 8f 8b 31 27 07 e4 b4 13 7c 80 cb e7 c5 e5 bc 7e 3a d7 60 11 c2 bb 12 ee 5f ae 4e 7c c3 36 be 22 ef 58 5e 4e 59 bc 23 d8 61 55 c7 14 7b 70 a5 9a 09 2f 7a 5a 22 0a 39 e9 6f 02 5c 47 49 f9 11 04 ee 58 0a 0c 64 04 62 b0 2a 4b fe 40 3b e6 05 50 d4 d2 46 2f 6a 7b c3 7d 4e 3f c6 78 fd 9d e9 5c 21 0e bb 7c 04 d4 81 ae 3e 1b 54 21 f5 63 74 70 ea 32 40 2d cb f0 cc 61 55 09 d1 aa 35 53 1a a1 6e 94 69 e8 c9 0f e8 15 17 07 f8 16 aa 7d 01 ad bb 78 51 d2 f8 0d 0d 25 d2

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: Cancellation_418406_Dec23.pdf

String found in binary or memory: http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip)

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; AEC=AakniGO7HqlHWlnoY-P22_SwwnNSfVGxlF1NgK5nuj5WLe313NyJi16g7z4; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o

Source: unknown

DNS traffic detected: queries for: agapeministriesinternational.church

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/Cancellation_367461_Dec23.zip HTTP/1.1Host: agapeministriesinternational.churchConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unarchiver.exe, 0000000F.00000002.606287284.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Found potential malicious PDF (bad image similarity)

Source: Cancellation_418406_Dec23.pdf

Static PDF information: Image stream: 6

Clickable URLs found in PDF pointing to potentially malicious files

Source: Cancellation_418406_Dec23.pdf	Initial sample: http://agapeministriesinternational.church/blog/cancellation_367461_dec23.zip
Source: Cancellation_418406_Dec23.pdf	Initial sample: http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\Fonts\ariblk.ttf

Jump to behavior

Source: Cancellation_418406_Dec23.pdf	Initial sample: http://agapeministriesinternational.church/blog/cancellation_367461_dec23.zip
Source: Cancellation_418406_Dec23.pdf	Initial sample: http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Cancellation_418406_Dec23.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1812,i,544507481073856773,15156316211615148029,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1812,i,544507481073856773,15156316211615148029,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5312:120:WilError_01

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx

Jump to behavior

Source: classification engine

Classification label: mal76.spre.winPDF@38/57@5/7

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: Cancellation_418406_Dec23.pdf	Initial sample: PDF keyword /JS count = 0
Source: Cancellation_418406_Dec23.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Cancellation_418406_Dec23.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6500	Thread sleep count: 119 > 30
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6500	Thread sleep time: -59500s >= -30000s

Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 15_2_00F0B1D6 GetSystemInfo,

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Spearphishing Link	Windows Management Instrumentation	Path Interception	11 Process Injection	3 Masquerading	1 Input Capture	1 Virtualization/Sandbox Evasion	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	3 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
agapeministriesinternational.church	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip	100%	Avira URL Cloud	malware
http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip)	0%	Avira URL Cloud	safe
http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip	16%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
agapeministriesinternational.church	50.62.149.105	true	true	3%, Virustotal, Browse	unknown
accounts.google.com	142.251.209.13	true	false		high
www.google.com	142.250.184.36	true	false		high
clients.l.google.com	142.250.184.78	true	false		high
clients2.google.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip)	Cancellation_418406_Dec23.pdf	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
50.62.149.105	agapeministriesinternational.church	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
142.250.184.78	clients.l.google.com	United States	15169	GOOGLEUS	false
142.251.209.13	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	778232
Start date and time:	2023-01-05 09:01:23 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Cancellation_418406_Dec23.pdf
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.spre.winPDF@38/57@5/7
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Find and activate links Security Warning found Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 2.21.22.155, 2.21.22.179, 23.211.4.250, 142.250.184.35, 34.104.35.123, 142.250.184.67
Excluded domains from analysis (whitelisted): ssl.adobe.com.edgekey.net, fs.microsoft.com, armmf.adobe.com, edgedl.me.gvt1.com, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, a122.dscd.akamai.net, update.googleapis.com, clientservices.googleapis.com, acroipm2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:02:21	API Interceptor	1x Sleep call for process: RdrCEF.exe modified

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.621995976318026
Encrypted:	false
SSDEEP:	3:m+lvns8RzYOCGLvHkWBGKuKjXKLNjKLuVlfl/1lQRktyrVNBiTFJrqzOJkvP5m1:men9YOFLvEWdM9QKftvPtYvi7Z+P41
MD5:	05A8ED13DB8ACF9593227A84C5C6FF47
SHA1:	6414B2E11A5C6EDA3AEDDF90585DC7AB6AA8817E
SHA-256:	6AD07D48B525B5EBE2DE9B7C4A074C01C366CCDD01080F8F65C378B8089C4227
SHA-512:	A392B1984BB041DB20B9AC85C423966E8D67F40D5774D82B9313626CB5F428454BD88C77D5CC82CC6DE18DC7EDB1BE95C6DAF387C92F19AB2AA799C613B4AEE4
Malicious:	false
Reputation:	low
Preview:	0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js ..mQ..P/....."#.D5.3....A.A..Eo......KX..............d.{v.^.G...d.W.:...P..k%..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.576331272896254
Encrypted:	false
SSDEEP:	3:m+lF9NX6v8RzYOCGLvHktWVeofl/Tk9kRktWfO98fZe/O+/rkwGhkg4m1:mi9NqEYOFLvEk5tT0jtV8Be7Ywcr1
MD5:	7F55774458FA8EA992A4750965A14D93
SHA1:	1B5B39ACACE70F1BC54D1746E2C8CC05D59E2028
SHA-256:	03A014EF976E41BDA70EBB3EE3775CDBF07AF033A808EE9DE7D3CDCEE58546B9
SHA-512:	5A413BEF7E1445D5C3A2E6D9026B07B7450BF322AC34B4E8C4CEF7EF39D02A177955B60F40C4A8DDDF72CA3A664C1EA59098D1110F79335805EC66A13DFA7475
Malicious:	false
Reputation:	low
Preview:	0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js ..N9..P/....."#.DS.....A.A..Eo...................1.x.'.vI..*\|Z..o...+.4....0..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.567684396308422
Encrypted:	false
SSDEEP:	6:mMyEYOFLvEWdVFLBKFjVFLBKFlQhuLm1u6OQt7XHmt/RlUoSjGY1:DyeRVFAFjVFAFXx9QFXGtZlUo6
MD5:	97CD0EFE5E2B8A3D74AEEE4842308710
SHA1:	8AA2676E49EE270AF8120524244A7BE5B58D3991
SHA-256:	3FDACB1B6DB3BC8535408C9A2598E2C9C9E6F84901CD5060A56CF2E9B9197ABC
SHA-512:	D40DC4F1773DDB3E1622493F6BBA336A01F0FE7C56A56659E9AF7AC55C99BC1314BA8EA9F92F70465F35E8EEE86277F64FCA7F02D87B2DA7743C88CAC757F551
Malicious:	false
Reputation:	low
Preview:	0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js ...O..P/....."#.D..-....A.A..Eo......Y..2..........hvDO.N.t@.....n.*...... ....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.64887853183383
Encrypted:	false
SSDEEP:	6:mNtVYOFLvEWdFCi5RsbH4A1Di9tGuiWulHyA1:IbRkiD6HH1+QjWus
MD5:	9EA125E9CF4BD143066AA72AB2D1D403
SHA1:	434C1A2C729CA4D40154E9F98FAE727767E4263D
SHA-256:	7A04211A73C7169FD4EB1FCC0D0B5B46198EAC7A4D233AC37E4F95394E1D3837
SHA-512:	7E4DEA9B51E264FE3D356B928F068C50C84D5BE07EFE1970830BC2E2D7AF1481B3C4AA6B75634A5AFAA637922BD6CF41E08C22221F60287E9CB22D010E2F1C0C
Malicious:	false
Preview:	0\r..m......h.....'....._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-tool-view.js .>w...P/....."#.D.z:....A.A..Eo....................8 P..a...R..Y....7.@..2Dm{..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.512939302571262
Encrypted:	false
SSDEEP:	6:m+yiXYOFLvEWd7VIGXVuQtItiGVyh9PT41:pyixRu3EGV41T
MD5:	A17F44A872680C207579A1A086788A99
SHA1:	9119588BADE75F7BBB909798C3048D4C78C49DED
SHA-256:	1ADD7711FDD7361A04F6F0680525B5529853D3CA300BA69DF0555322800DC321
SHA-512:	37C865F8FE9EC955A5DD7E71A57D266389E0858444C294AC2005196977E79CBE631334E5D9526A61C789DC24851FB33A4ED7ACB2C5788F7945466DBA185F7C21
Malicious:	false
Preview:	0\r..m......R...kP]g...._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/selector.js ..MP..P/....."#.Dk......A.A..Eo.......(G........k.Q.....-_..y.....O...>..1....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	216
Entropy (8bit):	5.612388645423502
Encrypted:	false
SSDEEP:	6:mvYOFLvEWdhwjQo4e8Bl9t6P/73ZIl6P41:0RhkMl9aDZ
MD5:	FF6F0A6F4A92165C2750003E38D98901
SHA1:	C9C78B3F5200C167C28357E2BE0DDD05A4D080CB
SHA-256:	73708B5FC326A0EF2172354612B07BB86E42C2515AD5F624344CC7BB9ED294C8
SHA-512:	B836830D4B854BF2693E5BD6E6F24718E0432E5C6DF47AF363A6C03F4D93A6B2917EF62AD013C34F7D10702BD2F06CC26E942980F8CB7D1AE528CFA0E5295653
Malicious:	false
Preview:	0\r..m......X.....V....._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/plugin.js ..EJ..P/....."#.D.......A.A..Eo........:.........].>....uUf..N...k......c..l.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.523770318520741
Encrypted:	false
SSDEEP:	3:m+lZd8RzYOCGLvHkWBGKuKjXKX7KoQRA/KVdKLuV2ll/X59lI9k6RktNcyxMtv9G:mJYOFLvEWdGQRQOdQ7tp9Ok9tND6g1
MD5:	C8E82FEB22D90B3991337437F2948FC4
SHA1:	8691CD0E6A3068871B3233EC70C7BA714160B08B
SHA-256:	7C752F349B50EBC49C0ABE460515311ADF5CA8291298F7EBFFB4BC8197A69910
SHA-512:	B2FDCBB762EC76A2D01B4CF75F798E5E37E7EBDEB2A791852AC9A4E68DB99E54EE84335086F621ECB6EEFA34A9B949B029820CA021101D51CC3958A79BBC0D2B
Malicious:	false
Preview:	0\r..m......Q..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/plugin.js ..^P..P/....."#.D.......A.A..Eo........g...........c..y/L....\|y.n..C/I.....X7-ne.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.5990078596133435
Encrypted:	false
SSDEEP:	3:m+lLp08RzYOCGLvHkfaMMuVeoH/l/NKqkRktg/l/VQMWqg4nRb7om5m1:mOYOFLvECMLPt8qjtg2uR/41
MD5:	3825DDDE75117D171E71E5A458925227
SHA1:	888D0794E3A82F286534336C13E2C1BE72DAC204
SHA-256:	5A710A6D29EC4856CDBDECF5DD80C0B4E6C50D9648F8F83670AEC94661FEA8EF
SHA-512:	018C790C06BE9DA972F4AAC61CE76B1E0865C64F973A93858F7455656ECAD0AC99925A5870BC1B69F6682FD7936F088B030037495E908B6DEBC76690908AD088
Malicious:	false
Preview:	0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js .N.9..P/....."#.D......A.A..Eo...................y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.645116909414164
Encrypted:	false
SSDEEP:	6:mGpYOFLvEWdzAAu9p9tXMGm0bbsIDMGH41:XfRM75MVKsIZ
MD5:	49C5D81D91FB71BC30A6194FF1EC9511
SHA1:	CD1CF4B7CAF5310114F568DCBEFAE30B5E6BEDB9
SHA-256:	013C484B65CF375E55A8D23396A38B83215541C89C688F95620783DFFC1A9824
SHA-512:	A2386258025F2A536DCE5A8D478B85F393683FF9CDEB65AADC05A35DD55CAD7EA00EB50B94C4C7B865AF0C2CB1E1893DB6B5CF063A62232FE7A6E32A27641337
Malicious:	false
Preview:	0\r..m......T....,.^...._keyhttps://rna-resource.acrobat.com/static/js/plugins/walk-through/js/selector.js .....P/....."#.D8Mh....A.A..Eo........Vw..........`.....^....L>..Xa./......C.y.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.50823459567584
Encrypted:	false
SSDEEP:	6:m4fPYOFLvEWdtuio41atOqKjtEhby0zBUKSAA1:pRHlAQ5ahb
MD5:	95844A96114E25247A2FF70296381B8F
SHA1:	9B7C3175BEA13C18EEBF7773A2978D94304F467B
SHA-256:	6DC9AF2C8078322C1D3F029FB277C539B1EC9C81E9B14A7F9D5BAAAAA501395B
SHA-512:	BC6B9BC933D31484E0A1024A9062CA179A23158983B69EF7433A9557BAFEE6053F10C0C2925A2D7C5DBA089D5F834B2E1F546A586325C33149031865BAC742BD
Malicious:	false
Preview:	0\r..m......V..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/search-summary/js/selector.js ..Q..P/....."#.D../....A.A..Eo.......N .........Q..E.=....=h`t..t..3%A.F$..w..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	177
Entropy (8bit):	5.464478515173832
Encrypted:	false
SSDEEP:	3:m+l64HXlA8RzYOCGLvHkjXMLOWFvrZ4Al/cbekRkt/gulWd1dn76KohyP5m1:md4HXXYOFLvEjMSWFvV4Atcbejt/LlWs
MD5:	3B017F44D6937A232DAF337527007722
SHA1:	BF073D4A3478DEB49B19168951EB4AF5BAE00BCB
SHA-256:	846C8930FE818F33EE410564FFEE3DCF8373729EC527BACB7178BEDE5FB9988D
SHA-512:	04634D17981352204AD8D850BDF187F0447A9B3ED828B785D4EC6978C4308E2898F558111D3FB8664783569262E8FCB76D109F095A0589F3ADC5234DB4833798
Malicious:	false
Preview:	0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js ..9..P/....."#.D......A.A..Eo......oA...........PU ....t^.....a.k..u.7.M.BW6#}..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.537214904794677
Encrypted:	false
SSDEEP:	3:m+lpSUlIv8RzYOCGLvHkWBGKuK2fKVLaOjval/JAT9k6RktxfNFtRUPqf9tsDMam:mkl9YOFLvEWsfOLaOjatEStx4PqVyM+e
MD5:	8BE056AB92C0B0E86E8B813D483AEE4F
SHA1:	57DAB50CBD799FC1602E10CAF834A0E6B7B9DA81
SHA-256:	2117ABF959441BA292E84E00F16C4EB5238A05694E58675FF05014FB198A55E6
SHA-512:	01AC1479A0393075FC49F4C16753A4A10C37CBEA13DE3F40C7A6637F5A647F7556F603279191C1EF481F9D30B95278E99859666FF58D73A98AD74CAACF4BC7CF
Malicious:	false
Preview:	0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js ...F..P/....."#.D......A.A..Eo.......`z...........q.O...j....._y..L^z...?..@N..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.592823378418027
Encrypted:	false
SSDEEP:	6:mt9YOFLvEWdVFLBKFjVFLBKFlyDMtK5BtZtwSeKaT9pr1:URVFAFjVFAFq5BjtwSeKaTL
MD5:	F84876297A72BEB1651728C1BFBC1656
SHA1:	C3A6235941079B657A7FA71E9F18BD0D781F76D0
SHA-256:	0D817919DDD0781C329CA59BF7825F621614506EEF0BEA06D02A38809444055A
SHA-512:	979A592311103B859550302B63A4C504E702902B57D78B79C3ADBEA59159081EE0F754A1DCB1B004FB557A13EF420E28DD8261D040A1B4BDBFCE04C4CB074DD7
Malicious:	false
Preview:	0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js .Y\P..P/....."#.D..9....A.A..Eo......8{T...............H...{...2../.k`..r4.C. .A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.542565577661833
Encrypted:	false
SSDEEP:	6:mq9YOFLvEWdzAHdQWZ1iltM0t5GFCaa+41:NRMHdjZUlS0t5Gda+
MD5:	2B30A71A95636FB7EB31ABBCD30914B1
SHA1:	EBCEB28F0DABD913F71C8E970B226DB750CE72A3
SHA-256:	3ACA663CF9476B74AA3AB2974971668E9CD3D7C33D66D1D107FD167C0E3FE949
SHA-512:	05753E498D442AC0C5CE4CA1074DDA1343D0BE042426C835378B74E3016015EE6DE30C2731B1F2D7DF938E72D92683703F706613049DF436D0383091E0891A9E
Malicious:	false
Preview:	0\r..m......R....L......_keyhttps://rna-resource.acrobat.com/static/js/plugins/walk-through/js/plugin.js .....P/....."#.D..i....A.A..Eo.......#.g...........G.3D.....Q.g0...._.Q.........A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.503044010207524
Encrypted:	false
SSDEEP:	3:m+lx4F08RzYOCGLvHkWBGKuKjXKGBIEGdevA/KPWFvq5Ll///RktWfJyrpYFm1:ms2VYOFLvEWdvBIEGdeXucRXKtWA11
MD5:	EAC791EA906DFF9FFFE142A9C3128082
SHA1:	1E64D921644E4255D83F8628BCF5B854D92E1CDF
SHA-256:	86A99F42FCA4331C519705EB534CDA3D56D404D6725BCD7425DB4AFB964E002B
SHA-512:	4BC2B0C9F5EB356D3BE2FE90EE03B51313034B26598DAF27FBA4D0A4A4DA47121AAD3D01C369C7F4A39AED209DC8A6235C0F3A9DB7A83DD241AEE2A110DDBED5
Malicious:	false
Preview:	0\r..m......S...]......._keyhttps://rna-resource.acrobat.com/static/js/plugins/add-account/js/selector.js ...O..P/....."#.D.......A.A..Eo......'............A.o]@r..Q.....<w.....].n\....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	5.607762882702344
Encrypted:	false
SSDEEP:	6:maVYOFLvEWdwAPCQvkWtj7xm7OhKlvA1:RbR16Q9xmJ
MD5:	557A0AA61BDFB25AD34327FE8435751A
SHA1:	85094D987F3F984A4EC70BCC250B0DCA39A0F2C8
SHA-256:	37C4521EDF38CAF2848CEB5771D7601D8CAF1A2B6BC32B5095E17219D016439B
SHA-512:	7E4C3CF8F9A57110DDBAAD102C7EF2C807D937D2CF5D31122BF3976141BCDB44C8B10D866172EACEA0F6F6D66B4512DE946FA9681BF566FA1B069B69AC087493
Malicious:	false
Preview:	0\r..m......J......{...._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/plugin.js ..(J..P/....."#.D.c.....A.A..Eo......D.............4T].....Tw.....(..b...EO....9.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.551307296605831
Encrypted:	false
SSDEEP:	6:ms2gEYOFLvEWdGQRQVuSMeQa0BtzdFt1:B2geRHRQHU
MD5:	B4A4AAF19733C12B4B33E2D15D0FCE58
SHA1:	8B163C6853DE9E60B357821A6FCFDB39D61544B6
SHA-256:	F0836551209222B402AF4FD01C08656F2E804400C03804F28148EF3C7614F234
SHA-512:	EAA75427B31C3B82E7D8E7E8C0AE2906482186D044077F650B4000DA87BA35BDDD97C06ED340942EC7BFD1FE81D4984653F9D1134AF17FDC17FB7E9A3E64F10C
Malicious:	false
Preview:	0\r..m......S...W.%z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/selector.js .orO..P/....."#.D..-....A.A..Eo.......$8.........@..{o]...9o\|..qY....T....{..u.b..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.627841101631036
Encrypted:	false
SSDEEP:	3:m+lerlyv8RzYOCGLvHkWBGKuKjXKX+IAHKLuVn/rmJO0kRktWtgEnNWQ1SUm1:mzyEYOFLvEWdrIOQESBtZEt1S/1
MD5:	64E8C64C6A112DC79EA38A6DA4FD9576
SHA1:	391CDCF1689D666F2CEFEC41B9CF7548C8A41B22
SHA-256:	9BDF5299BF039AEC674577CBDCC0CF2507FB7FAD9816BA7BBB943A4574CA6E7E
SHA-512:	ACCA0514DD114F827D7F875B6F9C16498FBB0D0978BA9F0B149FF03A9D4CBEDFD410124E7234E2E457E0B78D937E2A8E96FD481E975982EB50007FBE34A521C6
Malicious:	false
Preview:	0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js ..)H..P/....."#.D.i.....A.A..Eo......M............t\a......x5.'OuE.C..@......x..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.550674839202454
Encrypted:	false
SSDEEP:	3:m+lKcv8RzYOCGLvHkWBGKuKjXKoyNH/KPWFvJ5t/t9kRktYEt/glwJNqww6U+5m1:mnYOFLvEWdhwyuj51t9tDClwrqwK+41
MD5:	A86CDE160790DFE274404BFE174A765A
SHA1:	18E017F5E931422390B642FE1DC41DBCDD242959
SHA-256:	9D58599A524D65AD58B5ECA39F5E95C1A0C2AC19BFBE48BD9BE04C78506F3768
SHA-512:	10BD32F3764A343D3CFF0132BCB58CE7F73B8F2618BEE067AD41C44B8B305417464976218FB8C0798867EDD5BB5A7C1FEBF8D16B5315CD4C98105F4EB0EDB984
Malicious:	false
Preview:	0\r..m......Z.........._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/selector.js .,'J..P/....."#.D36.....A.A..Eo.......hD................7...o..a=.98I......(3.$G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.600848952677848
Encrypted:	false
SSDEEP:	6:mYXYOFLvEWdrROk/RJbuOWltntM0fO441:/RrROk/UpC0fL
MD5:	93B8F67BA6059DA3748FD998C5DBC788
SHA1:	3E623AD93172A25C525E4A78F0EEEC53813B6F83
SHA-256:	D383312016DB941640B947688007DD211A9EF754C5BC51BD0E6F0A0B42FCB0CF
SHA-512:	72287A5E1692BA88599436FD3C8E61539054EC43D12401EFDE982F9A6FE1EDC8FB28EADA7C03A664C88A2556A44D3D3C0C80AA500B10625F3B777B8D0EB19A26
Malicious:	false
Preview:	0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ...G..P/....."#.DPQ.....A.A..Eo.........^..........~..rw.+[....!.)?..f.U..(=.=.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	186
Entropy (8bit):	5.588810987211443
Encrypted:	false
SSDEEP:	3:m+lhD4ll08RzYOCGLvHkWBGKuKdTSVs+ll/oOJRktYT3zoIN1OFPL4m1:mmDEYOFLvEWXIjtoOQtYLzV1QPLr1
MD5:	CA823AA1C7CB0DFCEA3FE712B63A557D
SHA1:	12383F1280288995D7221C890ED488C9BAA1C861
SHA-256:	9C9604A8846253EF0A3790580196374917E239BC17E42DECFC1A3A9356AEED43
SHA-512:	1384029E9CE5160BBA3103D23F9AFFB54768AF2B81EA57935C84B4056D780D2FA7C3148DF4F50446A199C22DC75B74C38065FB042F7F2C86B9C38420E2C83287
Malicious:	false
Preview:	0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ..F..P/....."#.D.k.....A.A..Eo........&...........~]...%s..<...n.f..<.....1#..U..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.610626350115273
Encrypted:	false
SSDEEP:	3:m+l+nq1A8RzYOCGLvHkWBGKuKjXKLNfKPWFvkFTHt/PLc9k6RktE0//m8D6EsEJo:m52YOFLvEWdMAuqTVPoG9tl2EvsEJ41
MD5:	0926F994DE13EDA59A7E2CFC10281BE5
SHA1:	935830D69C61C55EDA95BF974779BCBADF853CED
SHA-256:	DF223F196F3927202A76E14C1A1D8C1CFE13138118102E542A4313D748211DE0
SHA-512:	4E8D2E51BA77EFA84583E313E3D8F5D59A1F80EAD845803A8859AA8C0E7220961A7E8ED49724C0AEEFE78F1EA1847BE3D18FB8EFCC28169E07142ED01CF5B185
Malicious:	false
Preview:	0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js ...O..P/....."#.DJC.....A.A..Eo......C(.)..........z._a...'.v.......4p3..1.']...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.583998485910321
Encrypted:	false
SSDEEP:	3:m+lf1UldA8RzYOCGLvHkWBGKuKjXK9QXAdWKfKPWFveCu/jQRkt3A/OFoDb7T2/1:mYilPYOFLvEWd8CAdAuPebt3long1
MD5:	3D95B90EB0979E07AEE7E94065292E5B
SHA1:	39683F5FD739A548B0A08DD9754FD8610F730908
SHA-256:	74724B37664F439C379CEF31A267E8146BE66C16892C8E2DD3BECF8297EC106B
SHA-512:	32ECD6CED29ADBD1F4A1E323CCFF61B5750702A8AD53C8C01CFEA1BEEAB636456CDA8CF3C29105A47E6253830A5478638897FBC1857F9B5D7406619E7F171A03
Malicious:	false
Preview:	0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js .;.O..P/....."#.D)^.....A.A..Eo.......B..........c}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.575019062802048
Encrypted:	false
SSDEEP:	3:m+l18t08RzYOCGLvHkWBGKuKjXKeRKVIJ/2oKPWFv6ll/fgnnkRktnEOe28WIJLA:mY8nYOFLvEWdrROk/IuwltqtEN16wG1
MD5:	1C1C09775D89160E3A7B6F61C8E20FF9
SHA1:	8019387BCB63D8091D68D2456C94281132FE4679
SHA-256:	1524F3BE3F93029528B9C62B04F50D4B8FC1445D6F41916343CFEC6865021BE2
SHA-512:	0E7F507F4CE4ED44FF1EB0F722B5B46F9D64515194655C4DA4195B97CD53ED83AF3DAA60CF54EC3264152A0423C90733955CF197642740187637800DA1B67635
Malicious:	false
Preview:	0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js .K.G..P/....."#.D.E.....A.A..Eo........}S..........%.k.SZ..~W.....:)'B..ad......A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.668873581676798
Encrypted:	false
SSDEEP:	3:m+lstxt08RzYOCGLvHkWBGKuKjXKX+IAuAJVKjXKLuVytoF//pzcqkRktrlePmJt:mLrnYOFLvEWdrIoJUQFaVdjtxeeJIi1
MD5:	D5EAB93751AC1B7A61F8E96AC211EF3F
SHA1:	FB8C7EA8C0F710DB3676D39A69E9F31A99BB2E76
SHA-256:	F6E3414FB2014966D04477625B51E19DEF36D3DA5A0B3DD8B49C85B1800325C8
SHA-512:	D1AB12BD803A180ADA820E3B2047A2953280633350C4C468C396807B04EFBF4FCB900D225D0FA71C50747B13F5FDBEBC2B442F07DD368E5111CB07181C04DA86
Malicious:	false
Preview:	0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js ..+H..P/....."#.D......A.A..Eo.......Z...........;"./N_.,.:C..2....9L.H...3:...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.5612368136651344
Encrypted:	false
SSDEEP:	6:mOEYOFLvEWdrIhuDVta2rIStD/xzgm2d/1:0R5VEEISV/xR
MD5:	7A6974EF458ABA31509126F8638D6F99
SHA1:	4B009AE03A7892EDBEEE77710D429C6BD3B63154
SHA-256:	BDD7527EDB021F834BFC94CA96B150B49D17B5B19B5C7C8B5CE1FFB95E4AA70B
SHA-512:	299EABF847D9BB30B390AF6688C5DB965AA889412EBA34320D1BA1040082288D8FC6E7EEB6B28F2B875929BB580A2F23E15952796B32B0C878CF7D3CF5D3A68D
Malicious:	false
Preview:	0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js ...G..P/....."#.D.......A.A..Eo..................Z.Z}Q..4.o....0+..[\|..n:*..U.W.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.606320392905866
Encrypted:	false
SSDEEP:	3:m+l8UElLA8RzYOCGLvHkWBGKuKPK7CvJ1+//YjI9JRktO1GBiaQ562HvpMm1:mAElVYOFLvEW1K4e/9Qtix56uvp1
MD5:	11399BA6433E5D2C6EAF25C0B93DB932
SHA1:	E081C102177D38FA90F9B475AC0EBCF0B66C7AC2
SHA-256:	537B0A06834A3FA7E046914387CC53C3AE93EBB3B3D1BD2393D72ACF63CC82E5
SHA-512:	8870BA6EDCF9560D6CBA7F4ED13F523FD32305F65A5ADBD7BD59736BFA907DC20917409441B70BF492999839BE3343EF851EC3ABF838C8A53EC327332D546A57
Malicious:	false
Preview:	0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js .*.<..P/....."#.D......A.A..Eo......+.2.........z?...SwC...^..y.....V..7R-O.....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.651471255775399
Encrypted:	false
SSDEEP:	6:mWYOFLvEWdBJvvusvesAHISt8UDLYtmOZn1:xRBJDeTDcFZ
MD5:	18D937FA69EE6EE16DE14487BE3D0F24
SHA1:	407556B89EFFBE80AB5D16BB78A31FFB2CBAC769
SHA-256:	2A58B426FC93AFD55F466FC88043755A89597C11A04A8BCC6DC7D60DB81A963C
SHA-512:	EA1873AE9199D6F8A51BFD6CFDAC39270D03AF9A304DA801EA24E7D8770F4C21AD603D55FC5CEAB2DDA1F37A312EE4E5330AB9772E5B5A65B504716A10D92EEA
Malicious:	false
Preview:	0\r..m......V.....h....._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/selector.js ...O..P/....."#.D.%.....A.A..Eo.......*..............t.q..W.EZ....1...[.zC.7mD..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.598506873098588
Encrypted:	false
SSDEEP:	3:m+lxCq//6v8RzYOCGLvHkWBGKuKCH6U4LJzWHK7WFvxZfl/2hylQRkt3llFpSKGi:msRPYOFLvEWIa7zp7Kt2ElPtt8VPu1
MD5:	B36CE60DABAE5C2C68ABCDF537B399A7
SHA1:	42511E2604CBA44236ADDDEA87BC8BE6A6FABA3F
SHA-256:	2761E6588D371710329B839163392855342C66187D477C9DF92FA1E768EB60FB
SHA-512:	5669770560C2AA4D98EF50C45881DEE87BBA91F9FE50BBEFB0C4F6B940CB4B836D3D1DE64F0B576B14D62DC0C481797C5AEA08E0FEDBBC2B9574ED89B638CE87
Malicious:	false
Preview:	0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js .`.9..P/....."#.D......A.A..Eo......g1m=...........L...Im.@.........E.nW...IP..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.572894941037124
Encrypted:	false
SSDEEP:	3:m+lQi9lC8RzYOCGLvHkWBGKuKjXKVRNUpXKLuVa//k9kRktJXl96F4XVAZ+8cV3I:mKPYOFLvEWdENU9QFItgwiM3Y1
MD5:	6C25D187D5522309902319CB0F2E04D1
SHA1:	D9B972270373BA977C08081B584FE4C196A91246
SHA-256:	1DF97D65306F71A7EA7C4668387B6C2DCEE3E26A39D2CAD26E399BEB72AF6686
SHA-512:	18B8DBD480501564B45FF1908935E3B506ED8F0CE71666EA3526966314EDE66A9C312D98C58B67EDE51F68FE4BE857A7B689CA3E6790294FB737CDE46430D6DC
Malicious:	false
Preview:	0\r..m......P...Yft....._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/plugin.js ..J..P/....."#.Dh......A.A..Eo......Qr.f...........M....m+lS..e.....<7.U.P8.0K.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.600545661828051
Encrypted:	false
SSDEEP:	6:mQt6EYOFLvEWdccAHQzAtRtCijBRCh/41:XRc9CcQiDi/
MD5:	42EA06B4F1B3D20D423F50E4781590C8
SHA1:	13D2FBF2085C500E4DB01F1D42FFA12569556A59
SHA-256:	25A3ED04D8F2358B9398C02966857B2CAECC4F9FAC7C48C3C7E6373304CE59E9
SHA-512:	0BBF27F3903CFE74D5C38BB9DB49215D1735A93D747C16A1122254578194BF9BA1799C3BF90E9415D16A3B22E72593C25EB8DBC9BC243B4AB347FAA94EF88272
Malicious:	false
Preview:	0\r..m......P...W3......_keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/plugin.js .Z]P..P/....."#.D..>....A.A..Eo.......(].........PJm...0x.x..RD...BB!@5..<..]....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.559487569468151
Encrypted:	false
SSDEEP:	6:mqs6XYOFLvEWdFCi5mhuqYVvttXl/l/kULlF4r1:bs6xRkirx3lt/7LlF4
MD5:	8C236DEE20477DDEAAB43674564AB50C
SHA1:	D225A033A89420C2E72776A2FA62AB55BF2CF840
SHA-256:	EFB50A6265C9B2646BF5CB846B5BE985770D9D80AC5191764B0041EDF8432271
SHA-512:	C4F46CF317C1D891F13612D01CB0D3A2A4C121ED6A084A28715D26BCD2BF724664C282B48782C56A2A879D8F773B680ED82ACDA136205A337F5B101B621A4C66
Malicious:	false
Preview:	0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js .x....P/....."#.D[.'....A.A..Eo......".K..........P...#4..l....5...5..).w.. .h.~..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.485797221682207
Encrypted:	false
SSDEEP:	3:m+lPHYs8RzYOCGLvHkWBGKuKjXKXqjuSKPWFvwal/dIXRktx91ECcu1isLK5m1:mhYOFLvEWd/aFuBtdIStJEN941
MD5:	2F6BB997FD2E326A5BBA37709986B17F
SHA1:	F0F1C8B3B50B1B0B74B9C137C3761BF23763870C
SHA-256:	01F38D7684A5BE497D1AB19C954BBC641B4D0BB18F59A07EE14FE2F89C2E4EB1
SHA-512:	0F6477D5D962E0B0A5A8EB7E1D763C04A18D8EEE83794A610E2FC49527AC24DD3F8474053A2C84DF9D13EE66970BB4966F95969B55739DC8CAA76DD9B1E41C1B
Malicious:	false
Preview:	0\r..m......W....w.m...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-recent-files/js/selector.js ...Q..P/....."#.De./....A.A..Eo.......l%............a.f.m.i.o.p..3U5.....^...I.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.51662120596477
Encrypted:	false
SSDEEP:	6:mR9YOFLvEWd7VIGXOdQF0lAt2StQBMqVd3G4K41:2DRuR20isSKB9Vd2
MD5:	8F8E284399A3C4CAEB29BF6033B0E4CA
SHA1:	BF5C22998C8B0346DEC0F95CFB57861EC31D12E9
SHA-256:	EE20292A9285CFA7B3DE1B28B303C798EC73E415C1925B02E6A029C3FA3F9C42
SHA-512:	704C8D0583137B2FBCB1798D881EBE77A96115536D350DCC0B4EDCDA315EEA9E7FE9BB153211B855C1B4E09DE45D4B7EA3D3A0C8CF44D71B6DAEA3BBEE10C812
Malicious:	false
Preview:	0\r..m......P...y.p....._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/plugin.js ...Q..P/....."#.DP......A.A..Eo.......!.r..........y.$..$.v5j...T...z.]..._S....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.557649370956887
Encrypted:	false
SSDEEP:	6:mkqYOFLvEWd8CAd9QGltcotFllDuA424r1:+RQXpxsr
MD5:	BA906F3502DB77FDB33FFDF846683B72
SHA1:	C6512A55A493082989422EF9B86F8375ECB53472
SHA-256:	DC1965981BAC7469337DD483732E9F782BFF3CC490A6151AA8EFB0ECD1C6A013
SHA-512:	00B130E788E8547B13475664683B4E6181EA18C949AC8280EA180AA0EBD9B0B789EBFB1C0D5542563660402EA871948512AEC55E199E287BA6E942625E82E59A
Malicious:	false
Preview:	0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js ..tQ..P/....."#.D..?....A.A..Eo..................#..@..k(v.8g..5.~_....]Pj.*..6.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.58392873454031
Encrypted:	false
SSDEEP:	3:m+lS5Etla8RzYOCGLvHkWBGKuKjXKVRNUp/KPWFv//1L9kRktgl7Ag2iHio/Mm1:moXXYOFLvEWdENUAul1L9tbyC8n1
MD5:	8D55D63C5CCBDF76D54A3A7B6D0B2DD4
SHA1:	957F82EE76A16B889A5E24EEBAB3828324946918
SHA-256:	EF5290A9633E5934007A8E556FB7A22465938D5C0BA493D70EC4A9638957F1AC
SHA-512:	BA80E4AC60F54D990BE4A2991447AAF3529E543375F1C5837D81CF1A0ACDC2878C1ADA41919679290DF9B9AF960262C77A90A86C2247E92003D1CB1DC13FCAD0
Malicious:	false
Preview:	0\r..m......R..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/selector.js .C.I..P/....."#.DB......A.A..Eo..................8.../...;.\\o....1..........+..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	221
Entropy (8bit):	5.596994789210489
Encrypted:	false
SSDEEP:	3:m+lFNrs8RzYOCGLvHkWBGKuKjXKeRKVIJ/2kKLuVc//kcG9kRktvE/sYWmYk5m1:mQZYOFLvEWdrROk/VQPa9tvE/sLmB41
MD5:	88AD3D637A4C91DFA2C03F846E38F919
SHA1:	9068B8C973A9202209D90DCA60ACBC79B7943F3D
SHA-256:	F20574E1CAD077A8DE728FEB5431A67D635A10BD1ADCA09EE2F7CC73AF5B6493
SHA-512:	6A69C903812702DDDFC6AE0AC2082EE4F0C7D6CA439EED3D7CF4BBE06F620B17CEB8B0889F788260BF97EBEF549D28F5AC0D429ED0C7799C138DB42EA7242CC6
Malicious:	false
Preview:	0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js .k-H..P/....."#.D.......A.A..Eo......e.......... ./.ev......N~..6.b.....$.j;:C...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.565040183022998
Encrypted:	false
SSDEEP:	6:mZ/lXYOFLvEWdccAWuyT4eSEtJ5dm9741:qxRcEEEf5du7
MD5:	BFB1E0BFD547650E0D8D2C598E14AAB1
SHA1:	11356D8D7377419AD0FC11A0B6E546037B9CA638
SHA-256:	AC020FB74E120DCE276617FE93E184DF0170BB2F5CDCBCEFC4516B841C7BE548
SHA-512:	DC12A24801E1A11900C078021D81C3ECD6A2C381824FF08F6C852544D99CDEF19908A54ECDA8256A4FF054492C629393202A58DCF1A9F2766042DC09AFBA7B17
Malicious:	false
Preview:	0\r..m......R...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/selector.js ...O..P/....."#.D..-....A.A..Eo.......\............U...I.>P...X...x..0U.~;m.x.k.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.601439502435024
Encrypted:	false
SSDEEP:	3:m+lUg18RzYOCGLvHkWBGKuKjXKrAUWiKPWFvwHt/+LkRktD//2B6shoq+Nem1:mMOYOFLvEWdwAPVuI1+PtD/OB6Jn1
MD5:	62FF3FEE75D6A47F2029EBD8410C365F
SHA1:	23CCB236A8B6C6D7F5B76D21C739D2F6E0DFA0A1
SHA-256:	BA1DA14D79DD90839078685DB5061B5CA3D85740AC10E57611D8B7704B3680E4
SHA-512:	954A0940F1AC6B7DDA4432715265F7642A69956EAB979229093387E105A7F001E75C8DE86D4110E51C0EBE5AFB9ED4C3001ED70CE4689FB483B5DAD9FB5649B5
Malicious:	false
Preview:	0\r..m......L....Ey....._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/selector.js .b.I..P/....."#.D.......A.A..Eo.......................k....F..D..O.n;[.1m.....=..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.63835904638504
Encrypted:	false
SSDEEP:	6:m3PXYOFLvEWdBJvYQXq+ltKISBtTl/AhcsBXIh1:mxRBJQEUI63/4B
MD5:	ACDAA9AB84DF748F3E332D8EB23FA2FD
SHA1:	078D843B39A851E5E3FE399E017BCC634AD26705
SHA-256:	5C877B08292E9E402A0E64EA2E85AC5D82BF9A6BBB96DD0EAA0254A56B778267
SHA-512:	18FAD91D215A2EB31E6683206B69F1302B6F9DE5701696FE1A027E76EBC7FD84BB6627E4C2A09277C7843D82EEBBDC99EB1C1318DACBBDAAA05839E96D334604
Malicious:	false
Preview:	0\r..m......T......z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/plugin.js .Y.Q..P/....."#.D.-/....A.A..Eo.....................k..`..N3.... ..d..$[.....{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.5998858495321455
Encrypted:	false
SSDEEP:	3:m+l4kC8RzYOCGLvHkWBGKuKjXKeRKVIJ/2NAJVKjXKLuVFAt/lAk6Rktn3Rlc3OK:msPYOFLvEWdrROk/RJUQZlPtrc3Me/1
MD5:	D0420A713C4C78DE127E5B6DF1F9A6DC
SHA1:	294EA17FD838BE667076B5A0933373A4B8ACC41E
SHA-256:	DA54A544204AA54FC9C73FEC67C42518EB3E6E4764A1F211EF64BCA5F93F4632
SHA-512:	DE0D42EDD2AEE317BB7A313A79858A43261D4AD948E68609A27A684F0DD04C7B7EA6F50738B1A4EC92AA325DEDD42FF7FCC3C72232F32055EB26E2581617B4C5
Malicious:	false
Preview:	0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js ...H..P/....."#.D%......A.A..Eo........}..............9Q].8O.z....=..:.N.{....N{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.029059890152802
Encrypted:	false
SSDEEP:	24:X4vPA5OnT9AMqOua0R5im8ZD/EX8hKx/61BW:CPpnTWgY8REXlZ8A
MD5:	B891934DBE6EB934EB98792AE7607A9D
SHA1:	F779156AEC614CC860306DEA05F7EDF2CF149B86
SHA-256:	7E74212BE3DEEC52C4BBF57A6883EC1FE28C22DFA0BF20A59829249EBE1B5913
SHA-512:	0AC0E0855746236159D84079AC959B1923A2584CE6C271DDC4DB77D2F36E198341AEC64CE8D73DD867A759FEA1AA4BFD87E10D810DD0C08CA06264C0C3325F13
Malicious:	false
Preview:	0...6...oy retne....+........V...............LH..P/...........;.y~A...9..P/..............oB..9..P/............#...(...A_./.............D.4..LH..P/..........[.i..%..LH..P/.............k7A..LH..P/..........]...I..C...P/...........2q.....LH..P/...........P....V..9..P/.........!...0.o.LH..P/............P[. q.LH..P/...........3....LH..P/..........v...q....9..P/...........a......9..P/..........C..M.....A_./.........,+..._.#.LH..P/.........<...W..J..9..P/..........J..j....LH..P/...........6<\|.....9..P/.........qi.K.L.9@\|..P/.........K..JM.gb@\|..P/.................C...P/.........F..=z;..LH..P/.............o..LH..P/.........Gy.'.h..LH..P/.........:..N.A...LH..P/.................LH..P/..........;/....LH..P/.........A?.2:...LH..P/..............q..LH..P/..........u\]..q.LH..P/..........o..k...LH..P/................LH..P/.........^.~..z..LH..P/..........+.{..'.LH..P/..........@..x..LH..P/.........)....J:.LH..P/..........&.S.....LH..P/............MV3...LH..P/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.029059890152802
Encrypted:	false
SSDEEP:	24:X4vPA5OnT9AMqOua0R5im8ZD/EX8hKx/61BW:CPpnTWgY8REXlZ8A
MD5:	B891934DBE6EB934EB98792AE7607A9D
SHA1:	F779156AEC614CC860306DEA05F7EDF2CF149B86
SHA-256:	7E74212BE3DEEC52C4BBF57A6883EC1FE28C22DFA0BF20A59829249EBE1B5913
SHA-512:	0AC0E0855746236159D84079AC959B1923A2584CE6C271DDC4DB77D2F36E198341AEC64CE8D73DD867A759FEA1AA4BFD87E10D810DD0C08CA06264C0C3325F13
Malicious:	false
Preview:	0...6...oy retne....+........V...............LH..P/...........;.y~A...9..P/..............oB..9..P/............#...(...A_./.............D.4..LH..P/..........[.i..%..LH..P/.............k7A..LH..P/..........]...I..C...P/...........2q.....LH..P/...........P....V..9..P/.........!...0.o.LH..P/............P[. q.LH..P/...........3....LH..P/..........v...q....9..P/...........a......9..P/..........C..M.....A_./.........,+..._.#.LH..P/.........<...W..J..9..P/..........J..j....LH..P/...........6<\|.....9..P/.........qi.K.L.9@\|..P/.........K..JM.gb@\|..P/.................C...P/.........F..=z;..LH..P/.............o..LH..P/.........Gy.'.h..LH..P/.........:..N.A...LH..P/.................LH..P/..........;/....LH..P/.........A?.2:...LH..P/..............q..LH..P/..........u\]..q.LH..P/..........o..k...LH..P/................LH..P/.........^.~..z..LH..P/..........+.{..'.LH..P/..........@..x..LH..P/.........)....J:.LH..P/..........&.S.....LH..P/............MV3...LH..P/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF4cd3b9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.029059890152802
Encrypted:	false
SSDEEP:	24:X4vPA5OnT9AMqOua0R5im8ZD/EX8hKx/61BW:CPpnTWgY8REXlZ8A
MD5:	B891934DBE6EB934EB98792AE7607A9D
SHA1:	F779156AEC614CC860306DEA05F7EDF2CF149B86
SHA-256:	7E74212BE3DEEC52C4BBF57A6883EC1FE28C22DFA0BF20A59829249EBE1B5913
SHA-512:	0AC0E0855746236159D84079AC959B1923A2584CE6C271DDC4DB77D2F36E198341AEC64CE8D73DD867A759FEA1AA4BFD87E10D810DD0C08CA06264C0C3325F13
Malicious:	false
Preview:	0...6...oy retne....+........V...............LH..P/...........;.y~A...9..P/..............oB..9..P/............#...(...A_./.............D.4..LH..P/..........[.i..%..LH..P/.............k7A..LH..P/..........]...I..C...P/...........2q.....LH..P/...........P....V..9..P/.........!...0.o.LH..P/............P[. q.LH..P/...........3....LH..P/..........v...q....9..P/...........a......9..P/..........C..M.....A_./.........,+..._.#.LH..P/.........<...W..J..9..P/..........J..j....LH..P/...........6<\|.....9..P/.........qi.K.L.9@\|..P/.........K..JM.gb@\|..P/.................C...P/.........F..=z;..LH..P/.............o..LH..P/.........Gy.'.h..LH..P/.........:..N.A...LH..P/.................LH..P/..........;/....LH..P/.........A?.2:...LH..P/..............q..LH..P/..........u\]..q.LH..P/..........o..k...LH..P/................LH..P/.........^.~..z..LH..P/..........+.{..'.LH..P/..........@..x..LH..P/.........)....J:.LH..P/..........&.S.....LH..P/............MV3...LH..P/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.22106866932705
Encrypted:	false
SSDEEP:	6:kOjYepcN+q2PWXp+N2nKuAl9OmbnIFUtjjYe9XZmwJjYeA3VkwOWXp+N2nKuAl91:kOU1IvaHAahFUtjUg/JUv5fHAaSJ
MD5:	2E7001C32D3007C69E1C881132991D74
SHA1:	338148D453B6A9D517C67D0050824085F35DE07C
SHA-256:	8A4B5C463EB52B3DA59E4E0110015640EF7B72BBB79BC35C7408F0451BF951F3
SHA-512:	84120307564F598C410000072EC2A4DDE7BF2F9695F064531A9325FEC0FBD66EF48896B17CD4A5B6DB04F768FCBF50D6B39F44484DB4E46516606ED5D3184A5D
Malicious:	false
Preview:	2023/01/05-09:02:26.340 728 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/01/05-09:02:26.350 728 Recovering log #3.2023/01/05-09:02:26.351 728 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.22106866932705
Encrypted:	false
SSDEEP:	6:kOjYepcN+q2PWXp+N2nKuAl9OmbnIFUtjjYe9XZmwJjYeA3VkwOWXp+N2nKuAl91:kOU1IvaHAahFUtjUg/JUv5fHAaSJ
MD5:	2E7001C32D3007C69E1C881132991D74
SHA1:	338148D453B6A9D517C67D0050824085F35DE07C
SHA-256:	8A4B5C463EB52B3DA59E4E0110015640EF7B72BBB79BC35C7408F0451BF951F3
SHA-512:	84120307564F598C410000072EC2A4DDE7BF2F9695F064531A9325FEC0FBD66EF48896B17CD4A5B6DB04F768FCBF50D6B39F44484DB4E46516606ED5D3184A5D
Malicious:	false
Preview:	2023/01/05-09:02:26.340 728 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/01/05-09:02:26.350 728 Recovering log #3.2023/01/05-09:02:26.351 728 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF4c4c2a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.22106866932705
Encrypted:	false
SSDEEP:	6:kOjYepcN+q2PWXp+N2nKuAl9OmbnIFUtjjYe9XZmwJjYeA3VkwOWXp+N2nKuAl91:kOU1IvaHAahFUtjUg/JUv5fHAaSJ
MD5:	2E7001C32D3007C69E1C881132991D74
SHA1:	338148D453B6A9D517C67D0050824085F35DE07C
SHA-256:	8A4B5C463EB52B3DA59E4E0110015640EF7B72BBB79BC35C7408F0451BF951F3
SHA-512:	84120307564F598C410000072EC2A4DDE7BF2F9695F064531A9325FEC0FBD66EF48896B17CD4A5B6DB04F768FCBF50D6B39F44484DB4E46516606ED5D3184A5D
Malicious:	false
Preview:	2023/01/05-09:02:26.340 728 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/01/05-09:02:26.350 728 Recovering log #3.2023/01/05-09:02:26.351 728 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.010978819626460943
Encrypted:	false
SSDEEP:	3:ImtVdXb+j4x9pPlXlpyPll//zVrzlltD0lGQZ7XEZhGIelHdP4/X:IiVtg4x9pdM//hFwl570ZhdelG/
MD5:	E36F8F81D3C03F6AAF7D768706B7673F
SHA1:	EECE93F9E417717892E50F6A159516DD76C255B0
SHA-256:	C6E687FF9677244574F37AD2877726DF64E5BAADDA2ABE8C4759BDE8344E44F2
SHA-512:	0582ADCFA1A09095D4482C9A61475C8B77FF444BF2655DE4F6583BBB2699A054BBB2292DE2741FEEB27AFE0835B0B48F476418EE1A666DE20CA146D1EB4390A4
Malicious:	false
Preview:	VLnk.....?.......Tq.>..j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-230105170223Z-212.bmp

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 164 x -115 x 32, cbSize 75494, bits offset 54
Category:	dropped
Size (bytes):	75494
Entropy (8bit):	2.4020228028982116
Encrypted:	false
SSDEEP:	192:zyAByfgu8b4OcFX3EhrFgACR3PUNesB3CRcj0M9VGCf9iuseJDhQBehvv3rvvPJr:zyAByY6rfAYfUNBxRpJFc6V4/I8aHr
MD5:	D67CF064FC7C7ABA560E46285869AEEE
SHA1:	6D641177A756D9794095224A6B5B30FCE45BEEC8
SHA-256:	924E28444D2BB3939F59D6C770E979CAA612C14F33097B31FBA6C513DF3494AE
SHA-512:	235AFDCA6196A55217D9FE0FCDBCFFD31A7D6AA3EAAF169DBF79AB475FE9197B5C0124D104F3F83E7438C3EF64E930578B20727C6E801D120ABFE335F5AA1D63
Malicious:	false
Preview:	BM.&......6...(............. ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000, file counter 12, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.564715552600696
Encrypted:	false
SSDEEP:	384:3eI9dThatELJ8fwRRwZsLRGlKhsvXh+vSc:ykYZsLQhUSc
MD5:	B15E8A8F33A5601830E856D5573DF225
SHA1:	A120DEB8D7DE2770921B5B26B9479D7BB124DBBE
SHA-256:	F52C1FC60D6D4C9123ED057BBFC32FA46A56B5595E1C2241388913C7E01CCD21
SHA-512:	9A55432D8AD36DEEF09BB4C5AF61DE9C26A2936A55F921463940F8E910AB100B5B531F03BE53B89C367884C0064176469C565984AD795AAEEB2CA136AD675349
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.284607295536086
Encrypted:	false
SSDEEP:	48:7M/om1CSiomeiom2om1Nom1Aiom1RROiom1oom1pom1jZiomVsiomgLqQlmFTIFv:7RSVOhnCsLN49IVXEBodRBk8
MD5:	A520C13D5593D1E7086D723EAB60B232
SHA1:	097223BD3549317F09FA926183CAC9960A2F8FF2
SHA-256:	78F75B8E967FD72B85D045446DC89259E2EF6950156A6399FD044E7AB3230A97
SHA-512:	8116921775C1B018AE5BA04A3E10BDDA9DE6B20A9CD27FB1B4E433DF1BFCC746AF2D7DD313BAD3286B6560B98139588308F8BB4F2F80A91B32DE662DFBCCFA50
Malicious:	false
Preview:	.... .c.....Z.>...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s........L.s.y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.2008

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	157443
Entropy (8bit):	5.172039478677
Encrypted:	false
SSDEEP:	1536:amNTjRlaRlQShhp2VpMKRhWa11quVJzlzofqG9Z0ADWp1ttawvayKLWbVG3+2:RNj3aRlQShhp2VpMKRhWa11quVJX2
MD5:	A2C6972A1A9506ACE991068D7AD37098
SHA1:	BF4D2684587CF034BCFC6F74CED551F9E5316440
SHA-256:	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65
SHA-512:	4D03884CA5D1652A79E6D55D8F92F4D138C47D462E05C3E6A685DA6742E98841D9C63720727203B913A179892C413BFB33C05416E1675E0CF80DA98BE90BA5E4
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Marlett.FamilyName:Marlett.StyleName:Regular.MenuName:Marlett.StyleBits:0.WeightClass:500.WidthClass:5.AngleClass:0.FullName:Marlett.WritingScript:Roman.WinName:Marlett.FileLength:27724.NameArray:0,Win,1,Marlett.NameArray:0,Mac,4,Marlett.NameArray:0,Win,1,Marlett.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:ArialMT.FamilyName:Arial.StyleName:Regular.MenuName:Arial.StyleBits:0.WeightClass:400.WidthClass:5.AngleClass:0.FullName:Arial.WritingScript:Roman.WinName:Arial.FileLength:1036584.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial.NameArray:0,Win,1,Arial.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Arial-BoldMT.FamilyName:Arial.StyleName:Bold.MenuName:Arial.StyleBits:2.WeightClass:700.WidthClass:5.AngleClass:0.FullName:Arial Bold.WritingScript:Roman.WinName:Arial Bold.FileLength:980756.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial Bold.NameAr

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	157443
Entropy (8bit):	5.172039478677
Encrypted:	false
SSDEEP:	1536:amNTjRlaRlQShhp2VpMKRhWa11quVJzlzofqG9Z0ADWp1ttawvayKLWbVG3+2:RNj3aRlQShhp2VpMKRhWa11quVJX2
MD5:	A2C6972A1A9506ACE991068D7AD37098
SHA1:	BF4D2684587CF034BCFC6F74CED551F9E5316440
SHA-256:	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65
SHA-512:	4D03884CA5D1652A79E6D55D8F92F4D138C47D462E05C3E6A685DA6742E98841D9C63720727203B913A179892C413BFB33C05416E1675E0CF80DA98BE90BA5E4
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Marlett.FamilyName:Marlett.StyleName:Regular.MenuName:Marlett.StyleBits:0.WeightClass:500.WidthClass:5.AngleClass:0.FullName:Marlett.WritingScript:Roman.WinName:Marlett.FileLength:27724.NameArray:0,Win,1,Marlett.NameArray:0,Mac,4,Marlett.NameArray:0,Win,1,Marlett.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:ArialMT.FamilyName:Arial.StyleName:Regular.MenuName:Arial.StyleBits:0.WeightClass:400.WidthClass:5.AngleClass:0.FullName:Arial.WritingScript:Roman.WinName:Arial.FileLength:1036584.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial.NameArray:0,Win,1,Arial.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Arial-BoldMT.FamilyName:Arial.StyleName:Bold.MenuName:Arial.StyleBits:2.WeightClass:700.WidthClass:5.AngleClass:0.FullName:Arial Bold.WritingScript:Roman.WinName:Arial Bold.FileLength:980756.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial Bold.NameAr

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2068
Entropy (8bit):	5.0863149791147855
Encrypted:	false
SSDEEP:	48:zFJbGYGbYGYGpiGbfGYGp3FkGbeG0FkGQGNGYGYGmHGYGNGYGmbP1+EEEEEEEEEY:x8MjKU9Q
MD5:	8A8E8565CCAA246BA9B71598B7038E38
SHA1:	27578ACD6D50E313A3BA1F5DB05EF479F0F9CF8B
SHA-256:	C783A44B81D1DEE63B86D0B1C036889E1DF5686A911785BBB9AC5F35AA32AFEC
SHA-512:	E7DBC97A56628ED6CA7F5B456AC31C1BC6C79DBF8ECF1B1D3E375F3C197FE2B4F8CC6476B2453A4D9551186EAAF83395A4E628FFA171130E724A0E4A79AF20CC
Malicious:	false
Preview:	01/05/2023 9:03 AM: Unpack: C:\Users\user\Downloads\Cancellation_367461_Dec23.zip..01/05/2023 9:03 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe..01/05/2023 9:03 AM: Received from standard out: ..01/05/2023 9:03 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..01/05/2023 9:03 AM: Received from standard out: ..01/05/2023 9:03 AM: Received from standard out: Scanning the drive for archives:..01/05/2023 9:03 AM: Received from standard out: 1 file, 801520 bytes (783 KiB)..01/05/2023 9:03 AM: Received from standard out: ..01/05/2023 9:03 AM: Received from standard out: Extracting archive: C:\Users\user\Downloads\Cancellation_367461_Dec23.zip..01/05/2023 9:03 AM: Received from standard out: --..01/05/2023 9:03 AM: Received from standard out: Path = C:\Users\user\Downloads\Cancellation_367461_Dec23.zip..01/05/2023 9:03 AM: Received from standard out: Type = zip..01/05/2023 9:03 AM: Received from standard out: Physical Size

C:\Users\user\Downloads\Cancellation_367461_Dec23.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	801520
Entropy (8bit):	7.999770193882168
Encrypted:	true
SSDEEP:	24576:wlDW7aQ9CEKLN0rvLPFMDcebEvbm37vcYep11QJ/6dP/z:MDWtKZ0+DczS3TcYefQJ/uP/z
MD5:	26097A602D65D1CC7E47D2A5E5D32895
SHA1:	78868EA9BD5CA1E5B591303C964C74CAC18F76EC
SHA-256:	9D4DD3EFB6149DA52E080EC9E91F1E64C5D0656F488FA78DCD6CE638EE75BA0B
SHA-512:	6BFD8ECCB1C7CE62B06F54728781ECC100389E129A98D831F3FE20DD79BD65CDDE2D91764993624161F906936672A0839790FEBAF86019B8A10BDC26D83D2DF1
Malicious:	false
Preview:	PK...........U....B:....j.....Cancellation#J58.isoya...B.do......;...\.....lk.).w..]..%....a...?.........j..)f...t..\|...-....p..[..47...:..l....8./.ZI.L.Q8...v..E....h...6s.G..P. ../........D.W8..@.g....-...M..}..hU..@.2.+y...D(..m..,.....M.\..k....l..l......Z..4....1a......s.....IA%....<.v.....BU..na.....Z~../H>.P....Z.g..)..b.,1.:..D?..M.x.F.~..Z..w%r'.e..zq6.2...9.v.r.@.a.7........h.FP....[,.S.7N.jO.ZI.(U(...).Qt.#...t ..nE..q...Yo.<..q....q.@...(...7..7!..z.D7...k....d.m...W.N}.V..v.0Ds..L.!.`U....}."........\.g..'..V.#.m...k..Y6+&..i..8..6..H.y@.....::.G..4.t....{....h..;dS.i.....j6.g...{Bl...b`...!#.Ol@.{...v_z.[.e.!....TW.A.[...P`.....+.g.k....:...xh...1'...\|.....~:.`...._.N\|.6.".X^NY.#.aU..{p.../zZ".9.o.\GI....X..d.b.K.@;..P..F/j{.}N?.x...\!..\|...>.T!.ctp.2@-...aU..5S..n.i..........}...xQ....%.x....i...1...~...!....>.GU.p....X.....w..%..../*......Z.;.wI...Ii.3...?Tddl'.D..uf.Io..@....7x...R.....).....U!...n..1.x#I7.M....]......N.&..

C:\Users\user\Downloads\Cancellation_367461_Dec23.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	801520
Entropy (8bit):	7.999770193882168
Encrypted:	true
SSDEEP:	24576:wlDW7aQ9CEKLN0rvLPFMDcebEvbm37vcYep11QJ/6dP/z:MDWtKZ0+DczS3TcYefQJ/uP/z
MD5:	26097A602D65D1CC7E47D2A5E5D32895
SHA1:	78868EA9BD5CA1E5B591303C964C74CAC18F76EC
SHA-256:	9D4DD3EFB6149DA52E080EC9E91F1E64C5D0656F488FA78DCD6CE638EE75BA0B
SHA-512:	6BFD8ECCB1C7CE62B06F54728781ECC100389E129A98D831F3FE20DD79BD65CDDE2D91764993624161F906936672A0839790FEBAF86019B8A10BDC26D83D2DF1
Malicious:	false
Preview:	PK...........U....B:....j.....Cancellation#J58.isoya...B.do......;...\.....lk.).w..]..%....a...?.........j..)f...t..\|...-....p..[..47...:..l....8./.ZI.L.Q8...v..E....h...6s.G..P. ../........D.W8..@.g....-...M..}..hU..@.2.+y...D(..m..,.....M.\..k....l..l......Z..4....1a......s.....IA%....<.v.....BU..na.....Z~../H>.P....Z.g..)..b.,1.:..D?..M.x.F.~..Z..w%r'.e..zq6.2...9.v.r.@.a.7........h.FP....[,.S.7N.jO.ZI.(U(...).Qt.#...t ..nE..q...Yo.<..q....q.@...(...7..7!..z.D7...k....d.m...W.N}.V..v.0Ds..L.!.`U....}."........\.g..'..V.#.m...k..Y6+&..i..8..6..H.y@.....::.G..4.t....{....h..;dS.i.....j6.g...{Bl...b`...!#.Ol@.{...v_z.[.e.!....TW.A.[...P`.....+.g.k....:...xh...1'...\|.....~:.`...._.N\|.6.".X^NY.#.aU..{p.../zZ".9.o.\GI....X..d.b.K.@;..P..F/j{.}N?.x...\!..\|...>.T!.ctp.2@-...aU..5S..n.i..........}...xQ....%.x....i...1...~...!....>.GU.p....X.....w..%..../*......Z.;.wI...Ii.3...?Tddl'.D..uf.Io..@....7x...R.....).....U!...n..1.x#I7.M....]......N.&..

C:\Users\user\Downloads\f1db83af-6dc2-44be-ad08-ad1b8f6a393d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	12426
Entropy (8bit):	7.986045610697938
Encrypted:	false
SSDEEP:	192:wQq1Fv+lodYd9vhN+W7rHGeZfn2BR/zPAfo028LiuOUlOiCo6r+XR7raexT4qR6E:/q1uFJE0tB4ZzMX95OUU9sdeOT7tjJn
MD5:	D09E144A7ED978AF106E813070C6DC12
SHA1:	DD127F78FB8FE3C55876927E6BDA8A3D9FA64CD3
SHA-256:	DFBDA2E1C8DFD9AB61E6E0522699E498499FBD6CAD02ABE3D90E51CACB2D2AC5
SHA-512:	1C15B50BB02885F72D99E997A2F86DDF83CAF12F2AE9E56704188DB302DB696A127D28EF5242B24D0AD9CB18B6F595707189C3A23D3335E0BD2CD544E84BD51B
Malicious:	false
Preview:	PK...........U....B:....j.....Cancellation#J58.isoya...B.do......;...\.....lk.).w..]..%....a...?.........j..)f...t..\|...-....p..[..47...:..l....8./.ZI.L.Q8...v..E....h...6s.G..P. ../........D.W8..@.g....-...M..}..hU..@.2.+y...D(..m..,.....M.\..k....l..l......Z..4....1a......s.....IA%....<.v.....BU..na.....Z~../H>.P....Z.g..)..b.,1.:..D?..M.x.F.~..Z..w%r'.e..zq6.2...9.v.r.@.a.7........h.FP....[,.S.7N.jO.ZI.(U(...).Qt.#...t ..nE..q...Yo.<..q....q.@...(...7..7!..z.D7...k....d.m...W.N}.V..v.0Ds..L.!.`U....}."........\.g..'..V.#.m...k..Y6+&..i..8..6..H.y@.....::.G..4.t....{....h..;dS.i.....j6.g...{Bl...b`...!#.Ol@.{...v_z.[.e.!....TW.A.[...P`.....+.g.k....:...xh...1'...\|.....~:.`...._.N\|.6.".X^NY.#.aU..{p.../zZ".9.o.\GI....X..d.b.K.@;..P..F/j{.}N?.x...\!..\|...>.T!.ctp.2@-...aU..5S..n.i..........}...xQ....%.x....i...1...~...!....>.GU.p....X.....w..%..../*......Z.;.wI...Ii.3...?Tddl'.D..uf.Io..@....7x...R.....).....U!...n..1.x#I7.M....]......N.&..

Static File Info

General

File type:	PDF document, version 1.3, 1 pages
Entropy (8bit):	7.795798037764297
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Cancellation_418406_Dec23.pdf
File size:	186639
MD5:	c085bbddc02251986f1fd8b84c5a404e
SHA1:	98d3377ff32441e24baa96f1d0fd83190e274c22
SHA256:	ca2d98108f12fb407cb0e1778febc9ff453ebbd8888e3b184cb8b9993775b5d8
SHA512:	02fef8a38f843cec18a6ca0e80cbb1ee23659534bab963d7ef0e8b522c2de1787666bfa4970c4d34d701ec4f652ba8bc583adca517fe5679e9d985bd2a3da59c
SSDEEP:	3072:fQcfk8aPgtSyiVLFkckuQMPhB20K8HR9hYDdfddlRCFwfkFPWN50kNSFHFUmV8N1:W8nwhFkZuvPDiYqdfddlVjbr03UmVruv
TLSH:	3504E0CCB13B76BFE8B77BB3A562835D374F6525732E6687088992A4C301F42D4510AE
File Content Preview:	%PDF-1.3.3 0 obj.<</Type /Page./Parent 1 0 R./Resources 2 0 R./Annots [5 0 R ]./Contents 4 0 R>>.endobj.4 0 obj.<</Filter /FlateDecode /Length 59>>.stream.x.3R..2.35W(.*T.01.32U0.BSKS=S C..@A.@..H!9WA..P.%_!... 4...endstream.endobj.5 0 obj.<</Type /Annot

File Icon


Icon Hash:	74ecccdcd4ccccf0

Static PDF Info

General
Header:	%PDF-1.3
Total Entropy:	7.795798
Total Bytes:	186639
Stream Entropy:	7.794817
Stream Bytes:	185459
Entropy outside Streams:	5.173523
Bytes outside Streams:	1180
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	8
endobj	8
stream	2
endstream	2
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
6	66f76b6664006000	fde72814e2e16d5b1a82d3b7cf0921d8

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2023 09:03:45.665621042 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:45.666202068 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.666264057 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.666347027 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.667125940 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:45.667155981 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:45.667221069 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:45.681859016 CET	49702	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:45.682480097 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.682548046 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.683199883 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:45.683228016 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:45.806641102 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:45.813993931 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:45.814045906 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:45.815979004 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:45.816091061 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:45.823188066 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:45.823334932 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:45.823719978 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:45.839335918 CET	80	49702	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:45.839426994 CET	49702	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:45.854161978 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.854439020 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.854484081 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.855062008 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.855139017 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.855910063 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.855979919 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.980948925 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:46.144690037 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:46.144759893 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.144988060 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:46.145015955 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.145217896 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.145606995 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:46.145653963 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.145747900 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:46.145764112 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.146033049 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.192888975 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.193018913 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:46.193053007 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.193342924 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.193413019 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:46.195028067 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:46.195064068 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.214713097 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.214826107 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:46.214858055 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.215186119 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.215260029 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:46.216869116 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:46.216905117 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:48.063569069 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063642025 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063687086 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063714027 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063734055 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.063755989 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063781023 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063797951 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.063807964 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063849926 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063875914 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063901901 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063932896 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.063934088 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.063934088 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221364021 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221400023 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221451044 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221481085 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221508026 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221533060 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221560955 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221589088 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221616983 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221647024 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221652985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221652985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221652985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221652985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221652985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221673965 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221702099 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221729994 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221733093 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221759081 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221882105 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221882105 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.379358053 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379399061 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379429102 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379458904 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379489899 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379523039 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379523039 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.379549980 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379580975 CET	49698	80	192.168.2.3	50.62.149.105

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2023 09:03:31.990242004 CET	57840	53	192.168.2.3	8.8.8.8
Jan 5, 2023 09:03:32.011425972 CET	53	57840	8.8.8.8	192.168.2.3
Jan 5, 2023 09:03:45.622262001 CET	60625	53	192.168.2.3	8.8.8.8
Jan 5, 2023 09:03:45.626640081 CET	49302	53	192.168.2.3	8.8.8.8
Jan 5, 2023 09:03:45.626899958 CET	53975	53	192.168.2.3	8.8.8.8
Jan 5, 2023 09:03:45.643832922 CET	53	60625	8.8.8.8	192.168.2.3
Jan 5, 2023 09:03:45.645402908 CET	53	53975	8.8.8.8	192.168.2.3
Jan 5, 2023 09:03:45.652929068 CET	53	49302	8.8.8.8	192.168.2.3
Jan 5, 2023 09:03:48.831399918 CET	60582	53	192.168.2.3	8.8.8.8
Jan 5, 2023 09:03:48.851125956 CET	53	60582	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2023 09:03:31.990242004 CET	192.168.2.3	8.8.8.8	0x58c	Standard query (0)	agapeministriesinternational.church	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.622262001 CET	192.168.2.3	8.8.8.8	0xf0a5	Standard query (0)	agapeministriesinternational.church	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.626640081 CET	192.168.2.3	8.8.8.8	0x7cc1	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.626899958 CET	192.168.2.3	8.8.8.8	0x9e81	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:48.831399918 CET	192.168.2.3	8.8.8.8	0xd046	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2023 09:03:32.011425972 CET	8.8.8.8	192.168.2.3	0x58c	No error (0)	agapeministriesinternational.church		50.62.149.105	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.643832922 CET	8.8.8.8	192.168.2.3	0xf0a5	No error (0)	agapeministriesinternational.church		50.62.149.105	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.645402908 CET	8.8.8.8	192.168.2.3	0x9e81	No error (0)	accounts.google.com		142.251.209.13	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.652929068 CET	8.8.8.8	192.168.2.3	0x7cc1	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2023 09:03:45.652929068 CET	8.8.8.8	192.168.2.3	0x7cc1	No error (0)	clients.l.google.com		142.250.184.78	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:48.851125956 CET	8.8.8.8	192.168.2.3	0xd046	No error (0)	www.google.com		142.250.184.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

agapeministriesinternational.church

Target ID:	0
Start time:	09:02:15
Start date:	05/01/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Cancellation_418406_Dec23.pdf
Imagebase:	0xc40000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: RdrCEF.exePID: 5448, Parent PID: 2156

General

Target ID:	1
Start time:	09:02:21
Start date:	05/01/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0x13c0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: chrome.exePID: 7152, Parent PID: 2156

General

Target ID:	11
Start time:	09:03:42
Start date:	05/01/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: chrome.exePID: 2364, Parent PID: 7152

General

Target ID:	14
Start time:	09:03:43
Start date:	05/01/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1812,i,544507481073856773,15156316211615148029,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: unarchiver.exePID: 6076, Parent PID: 7152

General

Target ID:	15
Start time:	09:03:50
Start date:	05/01/2023
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip
Imagebase:	0x640000
File size:	12800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Analysis Process: 7za.exePID: 5296, Parent PID: 6076

General

Target ID:	16
Start time:	09:03:51
Start date:	05/01/2023
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip
Imagebase:	0x1220000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 5312, Parent PID: 5296

General

Target ID:	17
Start time:	09:03:51
Start date:	05/01/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Tactics:	Initial Access
Data Sources:	DNS records, Detonation chamber, Email gateway, Mail server, Packet capture, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Cancellation_418406_Dec23.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Qbot Downloader

Yara Signatures

Initial Sample

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

Windows Analysis Report
Cancellation_418406_Dec23.pdf