26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4be,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Generik.FPOLTQH trojan Sample 4f6690b82ca4… — Score 40/100 — Hybrid Analysis","description":"Malicious verdict for sample 4f6690b82ca4…. Malware family: Generik.FPOLTQH trojan. Threat score 40/100. 0/28 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4f6690b82ca4b1f5735386729c4a04161e2cda9443cab700279eb583d9d21f70","keywords":["Malicious","Generik.FPOLTQH trojan","malware analysis","sandbox report","threat intelligence","4f6690b82ca4b1f5735386729c4a04161e2cda9443cab700279eb583d9d21f70"],"about":{"@type":"SoftwareApplication","name":"esma50-165-2251_crypto_assets_and_financial_stability.pdf","applicationCategory":["pdf"],"identifier":"4f6690b82ca4b1f5735386729c4a04161e2cda9443cab700279eb583d9d21f70","additionalType":"Malicious sample"},"threatScore":40,"malwareFamily":"Generik.FPOLTQH trojan","antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":0,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1e23,Object ID 4 contains compressed stream data: /P <</MCID 0>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 11.04 Tf 1 0 0 1 72.024 775.08 Tm /GS7 gs 0 g /GS8 gs 0 G [(\\)] TJ ET Q q 0.000008871 0 595.32 842.04 re W* n BT /F1 11.04 Tf 1 0 0 1 75.024 775.08 Tm 0 g 0 G [( )] TJ ET Q q 0.0 ... Object ID 17 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F2 12 Tf 1 0 0 1 72.024 816.84 Tm /GS7 gs 0 g /GS8 gs 0 G [( )] TJ ET Q q 0.000008871 0 595.32 842.04 re W* n Q EMC /P <</MCID 0 ... Object ID 29 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 38 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 45 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 54 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 62 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 75 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 85 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 95 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 99 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 105 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 110 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 118 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 126 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 170 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 172 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 174 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 842.04 re W* n BT /F1 6.96 Tf 1 0 0 1 72.024 821.28 Tm /GS7 gs 0.349 g /GS8 gs 0.349 G [(E)-4(S)-4(M)5(A)-4( T)-7(RV)-7( )] TJ ET Q q 0.000008871 0 595.32 ... Object ID 176 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 841.92 re W* n BT /F4 11.04 Tf 1 0 0 1 72.024 796.08 Tm /GS7 gs 0 g /GS8 gs 0 G [( )] TJ ET Q q 0.000008871 0 595.32 841.92 re W* n Q EMC /P <</MCI ... Object ID 185 contains compressed stream data: 183 0 187 52 190 104 191 176 189 246 188 312 186 376 192 447 193 521 194 578 195 635 196 692 198 749 199 801 197 853 200 925 203 978 204 1053 205 1131 202 1202 201 1276 206 1340 208 1393 209 1446 212 1499 213 1575 214 1646 215 1727 216 1803 217 1879 218 19 ... Object ID 705 contains compressed stream data: 702 0 708 60 709 113 710 166 711 220 712 279 707 333 706 425 698 485 713 554 697 609 718 670 719 724 723 778 722 836 725 896 724 954 720 1014 726 1091 727 1145 717 1199 716 1291 730 1351 729 1405 728 1465 715 1525 731 1586 714 1641 732 1702 733 1757 734 18 ... Object ID 1220 contains compressed stream data: 1218 0 1222 63 1221 122 1224 185 1223 244 1226 307 1225 366 1228 429 1227 488 1230 551 1229 610 1217 673 1233 781 1232 840 1235 903 1234 962 1237 1025 1236 1084 1239 1147 1238 1206 1241 1269 1240 1328 1243 1391 1242 1450 1231 1513 1246 1621 1245 1680 1248 ... Object ID 1500 contains compressed stream data: /CIDInit /ProcSet findresource begin 22 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ... Object ID 1501 contains compressed stream data: \x00\x01\x00\x00\x00\x0e\x01\x00\x00\x04\x00\x90OS/2\x14I\x83T\x00\x00\x01h\x00\x00\x00`cmapv:M1\x00\x00B|\x00\x00\x03fcvt \xad\xbf\xdf\x8e\x00\x00]\xc4\x00\x00\x06nfpgm8\xa5\x16+\x00\x00E\xe4\x00\x00?\xb0glyf@qGk\x00\x00d4\x00\x00\xe8\x0ehead\xebKV\xcc\x0 ... Object ID 1505 contains compressed stream data: \x00\x01\x00\x00\x00\x0e\x01\x00\x00\x04\x00`OS/2L\xbd\x94\xd4\x00\x00\x01h\x00\x00\x00`cmapa\x01O\x8b\x00\x00 \xb4\x00\x00\x01Zcvt k\x9a]\xb3\x00\x00 @\x00\x00\x038fpgm\xfb~S\x93\x00\x00\x0f\x10\x00\x00 \xafglyf\xe9\x05\x82u\x00\x00#x\x00\x00 8head\xear\x ...28:T10db,"https://www.mfsa.mt/our-work/virtual-financial-assets" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3888752" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.esma.europa.eu/press-news/esma-news/eu-financial-regulators-warn-consumers-risks-crypto-assets#:~:text=EU%20financial%20regulators%20warn%20consumers%20on%20the%20risks%20of%20crypto%2Dassets,-17%20March%202022&text=The%20European%20Supervisory%20Authorities%20(EBA,ensure%20they%20make%20informed%20decisions" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.fsb.org/wp-content/uploads/r_091107c.pdf?page_moved=1" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.theblock.co/data/decentralized-finance/exploits" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.bloomberg.com/news/articles/2022-05-12/money-markets-are-insulated-for-now-from-the-stablecoin-mess" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.ecb.europa.eu/press/pr/stats/if/html/ecb.ofi2022q1~02874985dd.en.html" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.fsb.org/2022/02/assessment-of-risks-to-financial-stability-from-crypto-assets" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.iosco.org/library/pubdocs/pdf/IOSCOPD699.pdf" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.bloomberg.com/news/articles/2022-03-23/terra-s-promise-of-20-defi-return-raises-sustainability-concern" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.iosco.org/library/pubdocs/pdf/IOSCOPD699.pdf?_x_tr_sl=en&_x_tr_tl=it&_x_tr_hl=it&_x_tr_pto=wapp" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.ecb.europa.eu/pub/financial-stability/fsr/special/html/ecb.fsrart202205_02~1cc6b111b4.en.html?utm_source=twitter&utm_medium=social&utm_campaign=fsrmay2022_PR2#toc5" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://roninblockchain.substack.com/p/back-to-building-ronin-security-breach?s=r" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://fortune.com/2021/02/08/bitcoin-price-tesla-purchase-elon-musk-crypto/#:~:text=Bitcoin%20price%20smashes%20%2444%2C000%20as%20market%20reacts%20to%20Tesla%20purchase,-By&text=The%20price%20of%20Bitcoin%20hit,to%20accept%20it%20as%20payment" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://uniswap.org/whitepaper-v3.pdf" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://medium.com/@versofinance/understanding-leveraged-yield-farming-72b5f8609a0a" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.bloomberg.com/news/features/2021-10-07/crypto-mystery-where-s-the-69-billion-backing-the-stablecoin-tether?srnd=premium&sref=SCKvL4TY" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://arxiv.org/pdf/2003.03810.pdf?ref=https://githubhelp.com" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.diem.com/en-us" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.mastercard.com/news/perspectives/2021/why-mastercard-is-bringing-crypto-onto-our-network" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.ft.com/content/a119dc9e-189d-4a87-ae02-a81a37260196" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.consob.it/documents/11973/1421036/RSC_june+2022/104433fd-f2d4-492e-b6b9-17d42319d9da" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://www.bis.org/publ/bisbull56.pdf" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf") "https://certik.medium.com/what-is-a-ddos-attack-how-can-it-affect-crypto-4f62cc1cad8c" (Based on: "esma50-165-2251_crypto_assets_and_financial_stability.pdf")29:Taa1,"urlref_httpswww.theblock.codatadecentralized-financeexploits" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: 00000000-00006504] "urlref_httpswww.fsb.orgwp-contentuploadsr_091107c.pdfpage_moved_1" has type "PDF document version 1.6"- [targetUID: 00000000-00006504] "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: 00000000-00006504] "urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: 00000000-00006504] "urlref_httpswww.esma.europa.eupress-newsesma-newseu-financial-regulators-warn-consumers-risks-crypto-assets#~text_EU%20financial%20regu" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: 00000000-00006504] "A9Rlhho24_1u06xis_50o.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rlhho24_1u06xis_50o.tmp]- [targetUID: 00000000-00006504] "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00006504] "A9Radrka3_1u06xiv_50o.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Radrka3_1u06xiv_50o.tmp]- [targetUID: 00000000-00006504] "Annssi.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00006504] "Annss.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00006504] "addressbook.acrodata" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00006504] "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00006504] "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00006504] "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00006504] "Annssk.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00006504] "FAP50E7.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\FAP50E7.tmp]- [targetUID: 00000000-00006504]2a:T1623,Heuristic match: "ESMA Report on Trends, Risks and Vulnerabilities Risk Analysis \xa9 European Securities and Markets Authority, Paris, 202 2. All rights reserved. Brief excerpts may be reproduced or translated provided the source is cited adequately. Legal reference for th" Pattern match: "https://www.mfsa.mt/our-work/virtual-financial-assets" Pattern match: "https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3888752" Pattern match: "https://www.esma.europa.eu/press-news/esma-news/eu-financial-regulators-warn-consumers-risks-crypto-assets#:~:text=EU%20financial%20regulators%20warn%20consumers%20on%20the%20risks%20of%20crypto%2Dassets,-17%20March%202022&text=The%20European%20Supervisory" Pattern match: "https://www.fsb.org/wp-content/uploads/r_091107c.pdf?page_moved=1" Pattern match: "https://www.theblock.co/data/decentralized-finance/exploits" Pattern match: "https://www.bloomberg.com/news/articles/2022-05-12/money-markets-are-insulated-for-now-from-the-stablecoin-mess" Pattern match: "https://www.ecb.europa.eu/press/pr/stats/if/html/ecb.ofi2022q1~02874985dd.en.html" Pattern match: "https://www.fsb.org/2022/02/assessment-of-risks-to-financial-stability-from-crypto-assets" Pattern match: "https://www.iosco.org/library/pubdocs/pdf/IOSCOPD699.pdf" Pattern match: "https://www.bloomberg.com/news/articles/2022-03-23/terra-s-promise-of-20-defi-return-raises-sustainability-concern" Pattern match: "https://www.iosco.org/library/pubdocs/pdf/IOSCOPD699.pdf?_x_tr_sl=en&_x_tr_tl=it&_x_tr_hl=it&_x_tr_pto=wapp" Pattern match: "https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html" Pattern match: "https://www.ecb.europa.eu/pub/financial-stability/fsr/special/html/ecb.fsrart202205_02~1cc6b111b4.en.html?utm_source=twitter&utm_medium=social&utm_campaign=fsrmay2022_PR2#toc5" Pattern match: "https://roninblockchain.substack.com/p/back-to-building-ronin-security-breach?s=r" Pattern match: "https://fortune.com/2021/02/08/bitcoin-price-tesla-purchase-elon-musk-crypto/#:~:text=Bitcoin%20price%20smashes%20%2444%2C000%20as%20market%20reacts%20to%20Tesla%20purchase,-By&text=The%20price%20of%20Bitcoin%20hit,to%20accept%20it%20as%20payment" Pattern match: "https://uniswap.org/whitepaper-v3.pdf" Pattern match: "https://medium.com/@versofinance/understanding-leveraged-yield-farming-72b5f8609a0a" Pattern match: "https://www.bloomberg.com/news/features/2021-10-07/crypto-mystery-where-s-the-69-billion-backing-the-stablecoin-tether?srnd=premium&sref=SCKvL4TY" Pattern match: "https://arxiv.org/pdf/2003.03810.pdf?ref=https://githubhelp.com" Pattern match: "https://www.diem.com/en-us" Pattern match: "https://www.mastercard.com/news/perspectives/2021/why-mastercard-is-bringing-crypto-onto-our-network" Pattern match: "https://www.ft.com/content/a119dc9e-189d-4a87-ae02-a81a37260196" Pattern match: "https://www.consob.it/documents/11973/1421036/RSC_june+2022/104433fd-f2d4-492e-b6b9-17d42319d9da" Pattern match: "https://www.bis.org/publ/bisbull56.pdf" Pattern match: "https://certik.medium.com/what-is-a-ddos-attack-how-can-it-affect-crypto-4f62cc1cad8c" Pattern match: "https://extropy-io.medium.com/solanas-wormhole-hack-post-mortem-analysis-3b68b9e88e13" Pattern match: "https://decrypt.co/101867/solana-plummets-double-digits-amid-another-network-halt" Pattern match: "https://help.ftx.com/hc/en-us/articles/360032509552-Leveraged-Token-Walkthrough-READ-THIS" Pattern match: "https://www.fsb.org/work-of-the-fsb/financial-innovation-and-structural-change/crypto-assets-and-global-stablecoins" Pattern match: "https://www.nber.org/papers/w30006" Pattern match: "https://future.com/how-composability-unlocks-crypto-and-everything-else" Pattern match: "https://www.sifma.org/resources/research/fact-book" Pattern match: "https://www.iosco.org/news/pdf/IOSCONEWS649.pdf" Pattern match: "https://future.com/how-composability-unlocks-crypto-and-everything-else/" Pattern match: "https://insights.glassnode.com/bitcoin-supply-distribution" Pattern match: "https://coinsutra.com/margin-trading-crypto-exchanges" Pattern match: "https://blog.chain.link/how-chainlink-supports-any-off-chain-data-resource-and-computation" Pattern match: "https://blog.coinshares.com/there-is-more-pain-to-come-in-the-crypto-markets-d9588457fb07" Pattern match: "https://defillama.com" Pattern match: "https://www.fca.org.uk/publications/research/research-note-cryptoasset-consumer-research-2021" Pattern match: "https://bitcoin.org/bitcoin.pdf" Pattern match: "https://www.theblock.co" Pattern match: "https://www.amf-france.org/en/professionals/fintech/my-relations-amf/obtain-dasp-authorisation" Pattern match: "https://www.fidelitydigitalassets.com/research-and-insights/2021-institutional-investor-digital-assets-study" Pattern match: "https://blog.kaiko.com/how-crypto-might-insulate-from-scary-macro-320d2c3c342f" Pattern match: "https://finance.ec.europa.eu/publications/digital-finance-package_en" Pattern match: "https://coinsutra.com/margin-trading-crypto-exchanges/" Heuristic match: "qc.aD" Heuristic match: "'m.Ae" Pattern match: "https://www.theblock.co/" Pattern match: "https://www.diem.com/en-us/" Pattern match: "https://insights.glassnode.com/bitcoin-supply-distribution/" Heuristic match: "-..NO" Heuristic match: "ft.nC" Heuristic match: "`aq(.aq" Heuristic match: "dd1G.sM" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://purl.org/dc/elements/1.1/" Pattern match: "http://ns.adobe.com/xap/1.0/mm/" Pattern match: "https://www.verisign.com/rpa" Pattern match: "www.adobe.com/misc/pki/prod_svce_cps.html0http://crl.adobe.com/cds\.crl0z0x1US1#0!Adobe"2b:T641,Found HTTPS url "https://www.esma.europa.eu" Found HTTPS url "https://bitcoin.org" Found HTTPS url "https://blog.coinshares.com" Found HTTPS url "https://blog.kaiko.com" Found HTTPS url "https://www.iosco.org" Found HTTPS url "https://defillama.com" Found HTTPS url "https://www.ft.com" Found HTTPS url "https://help.ftx.com" Found HTTPS url "https://medium.com" Found HTTPS url "https://bitinfocharts.com" Found HTTPS url "https://coinsutra.com" Found HTTPS url "https://decrypt.co" Found HTTPS url "https://certik.medium.com" Found HTTPS url "https://uniswap.org" Found HTTPS url "https://blog.chain.link" Found HTTPS url "https://www.theblock.co" Found HTTPS url "https://roninblockchain.substack.com" Found HTTPS url "https://extropy" Found HTTPS url "https://www.ecb.europa.eu" Found HTTPS url "https://www.diem.com" Found HTTPS url "https://www.mastercard.com" Found HTTPS url "https://finance.ec.europa.eu" Found HTTPS url "https://www.amf" Found HTTPS url "https://www.mfsa.mt" Found HTTPS url "https://www.fsb.org" Found HTTPS url "https://www.bis.org" Found HTTPS url "https://www.bloomberg.com" Found HTTPS url "https://papers.ssrn.com" Found HTTPS url "https://www.fca.org.uk" Found HTTPS url "https://www.sifma.org" Found HTTPS url "https://www.consob.it" Found HTTPS url "https://www.nber.org" Found HTTPS url "https://www.fidelitydigitalassets.com" Found HTTPS url "https://arxiv.org" Found HTTPS url "https://githubhelp.com" Found HTTPS url "https://fortune.com" Found HTTPS url "https://insights.glassnode.com" Found HTTPS url "https://future.com"2c:T8cf,"https://www.ecb.europa.eu/press/pr/stats/if/html/ecb.ofi2022q1~02874985dd.en.html" (Source: esma50-165-2251_crypto_assets_and_financial_stability.pdf, Indicator: "ecb.eu") "https://www.ecb.europa.eu/pub/financial-stability/fsr/special/html/ecb.fsrart202205_02~1cc6b111b4.en.html?utm_source=twitter&utm_medium=social&utm_campaign=fsrmay2022_PR2#toc5" (Source: esma50-165-2251_crypto_assets_and_financial_stability.pdf, Indicator: "ecb.eu") "endstreamendobj100 0 obj<>/F 4/A<>/StructParent 42>>endobj101 0 obj<>/F 4/A<>/StructParent 43>>endobj102 0 obj<>/ExtGState<>>>/BBox[ 0 0 209.42 172.81] /Matrix[ 0.34381 0 0 0.41664 0 0] /Filter/FlateDecode/Length 1205>>streamx" (Source: esma50-165-2251_crypto_assets_and_financial_stability.pdf, Indicator: "ecb.eu") "/A<>/StructParent 67>>endobj137 0 obj<>/F 4/A<>/StructParent 68>>endobj138 0 obj<>/F 4/A<>/StructParent 69>>endobj139 0 obj<>/F 4/A<>/StructParent 70>>endobj140 0 obj<>/F 4/A<<" (Source: esma50-165-2251_crypto_assets_and_financial_stability.pdf, Indicator: "ecb.eu")2d:T524,Dropped file: "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00006504] Dropped file: "Annssi.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00006504] Dropped file: "Annss.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00006504] Dropped file: "addressbook.acrodata" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00006504] Dropped file: "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00006504] Dropped file: "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00006504] Dropped file: "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00006504] Dropped file: "Annssk.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00006504]2e:Tdfe,"RdrCEF.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72d00000 "RdrCEF.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "RdrCEF.exe" loaded module "KERNEL32" at base 774e0000 "RdrCEF.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "RdrCEF.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75720000 "RdrCEF.exe" loaded module "SHLWAPI.DLL" at base 76df0000 "RdrCEF.exe" loaded module "%PROGRAMFILES%\ADOBE\ACROBAT READER DC\READER\ACROCEF\ICUDT.DLL" at base 61da0000 "RdrCEF.exe" loaded module "KBDUS.DLL" at base 6e560000 "RdrCEF.exe" loaded module "CRYPTBASE.DLL" at base 75490000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 741c0000 "RdrCEF.exe" loaded module "KERNEL32.DLL" at base 774e0000 "RdrCEF.exe" loaded module "DHCPCSVC6.DLL" at base 73450000 "RdrCEF.exe" loaded module "IPHLPAPI.DLL" at base 74af0000 "RdrCEF.exe" loaded module "DHCPCSVC.DLL" at base 74a20000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\AUDIOSES.DLL" at base 6e0c0000 "RdrCEF.exe" loaded module "SETUPAPI.DLL" at base 76fb0000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\WLANAPI.DLL" at base 727b0000 "RdrCEF.exe" loaded module "NTDLL.DLL" at base 77690000 "RdrCEF.exe" loaded module "ADVAPI32.DLL" at base 76c70000 "RdrCEF.exe" loaded module "WINHTTP.DLL" at base 70ba0000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75440000 "RdrCEF.exe" loaded module "CREDSSP.DLL" at base 74c60000 "RdrCEF.exe" loaded module "RPCRT4.DLL" at base 76f00000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74f60000 "RdrCEF.exe" loaded module "WSHIP6.DLL" at base 74f50000 "RdrCEF.exe" loaded module "RASADHLP.DLL" at base 71db0000 "RdrCEF.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "RdrCEF.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "RdrCEF.exe" loaded module "COMCTL32.DLL" at base 743e0000 "RdrCEF.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 756c0000 "RdrCEF.exe" loaded module "LIBCEF.DLL" at base 62a70000 "RdrCEF.exe" loaded module "OLE32.DLL" at base 77180000 "RdrCEF.exe" loaded module "NTMARTA.DLL" at base 74ab0000 "RdrCEF.exe" loaded module "USER32.DLL" at base 777f0000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 73750000 "RdrCEF.exe" loaded module "DWMAPI.DLL" at base 73d50000 "RdrCEF.exe" loaded module "SHCORE.DLL" at base 0 "RdrCEF.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 774e0000 "RdrCEF.exe" loaded module "CFGMGR32.DLL" at base 75650000 "RdrCEF.exe" loaded module "WINTRUST.DLL" at base 75690000 "RdrCEF.exe" loaded module "CLBCATQ.DLL" at base 76b30000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 74010000 "RdrCEF.exe" loaded module "SSPICLI.DLL" at base 75420000 "RdrCEF.exe" loaded module "MSCMS.DLL" at base 61d20000 "RdrCEF.exe" loaded module "WS2_32.DLL" at base 75bb0000 "RdrCEF.exe" loaded module "CRYPTSP.DLL" at base 74fa0000 "RdrCEF.exe" loaded module "NSI.DLL" at base 75bf0000 "RdrCEF.exe" loaded module "OLEAUT32.DLL" at base 76bc0000 "RdrCEF.exe" loaded module "DNSAPI.DLL" at base 74e20000 "RdrCEF.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 0 "RdrCEF.exe" loaded module "ADVAPI32" at base 76c70000 "RdrCEF.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "RdrCEF.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c310000 "RdrCEF.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 02f:T18e0,Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets")30:T486,Found string "" (Indicator: ".googleapis.com"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") Found string "" (Indicator: ".googleapis.com"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") file/memory contains long string with (Indicator: ".googleapis.com"; File: "urlref_httpswww.mfsa.mtour-workvirtual-financial-assets") file/memory contains long string with (Indicator: ".googleapis.com"; File: "urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752") Found string "" (Indicator: ".googleapis.com"; File: "urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752") Found string "" (Indicator: ".googleapis.com"; File: "urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752")31:T4e4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADcUlEQVR4XuWVy0tUURzH569o1WMRRFGtamFg0S43RQ8syhYZLqKCQKRNFIFhCxdGtAnbVOIiephhED3Ix6STWpom49T4mIfjqPO4d+6dp/rt/o7e67ln5uqdUAj6wYfhzJxzP9/zO2dmHI5/vQKBAAi/32+gvxcMBjE1NYVQKITp6WlGOBzGzMwMZmdnGUNDQxCfWVTxcp/PZwQguRiA5HyAubk5jI6Owu12W4eIbXNgI6BAFGBiYoIF9Xq9hUNEtMny/k3rCj2TOkUB6DWRSBjHKPod4a0OiOS0tqa6OhGtubY0Dk0h/WMQkcoKNp7X2pweGoTy+lXeWh3aeSQSYdJ0Og1JklgnxsfHzSFC2mSRzJgX4RNlSH11LY3HxxAq2Q3104eVcYF1PHoAar1+h+g9j8djDhHY4oBITrtESvtnhC9VsTEJ6TX9+9fS51prU9SR+w15a3VIFo1GEYvFEI/HGdQFWZYZRoBJbbJIWuuAaawF8B8ugfqt3xiLa/KYnLSU050wAng3OyCSHPlpGme0O6AMfIevopyNU6PuvDUi9JW1kiuKshLAo03eCOjMreSmAG5t8kZAX7tCclVVGUaAtaqjowPt7e0GnZ2djK6uLjidTnR3d6Onp4fhcrnQ29uL4eFh9ouoi0V5Mpm0H4Aukwidr06h/wiS0wXkW87LU6mU/QD0IBH9chHyxzYkrpyG/Oieqd2Fdq3LiwrAy/hbrZN4UAfZMwL5fJlJbCWnX0VC9FgWL+MvlbHblmYkXjRBvnhyVbEuz2QyDNFjWXnC5V0auw0FIR3aicTDhlXFvDybzdoPYJIt75CHhNLBXVAH+m2JiVwuZz+AKOMhmTrQB+loKeTbNbbExPz8vP0AopCHZPLNaihPGqG2PofyrGlNMbGwsGA/gNhWE0E/ovu2I9nngvK4EfGqCsTOHINcXwfpzi3Id2vzxMTi4qL9AGJbddT3bxErK0X8QjnUd23Iqgrbrdr6EtKN61Can2Jmzw6TnMQEleixLL6lRDrgg3S5Eon6WkQO7EVGlkxtZjum0F+cyPomTWJdXlQA/Rx14pVnWYjo8SNIOTvyzldsNS/lS/RYFr8zIl59FbFzp5B807Kq1Eqsl+ixLF5SSFiMlC/RY1m8qJCwGClfoseyRNnfCsUSPZYlLlyvEj3/b/0BO68O7y1qJHUAAAAASUVORK5CYII=32:T5c2,--type=renderer --primordial-pipe-token=FEABAE347262F26F55EC39025A39A467 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=FEABAE347262F26F55EC39025A39A467 --renderer-client-id=2 --mojo-platform-channel-handle=1284 --allow-no-sandbox-job /prefetch:133:T5c2,--type=renderer --primordial-pipe-token=8534836A86C6502C05BF4409F6178FDA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=8534836A86C6502C05BF4409F6178FDA --renderer-client-id=3 --mojo-platform-channel-handle=1328 --allow-no-sandbox-job /prefetch:11d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4f6690b82ca4b1f5735386729c4a04161e2cda9443cab700279eb583d9d21f70","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":40,"unified_at_epoch_ms":1790797353294,"unified_at":"2026-09-30T19:42:33.294Z","metadata":{"hashes":{"sha256":"4f6690b82ca4b1f5735386729c4a04161e2cda9443cab700279eb583d9d21f70","sha1":"31afc12130d8deceb007cca3af0c959772d236b4","md5":"80c1256f8bb2a9572e20dd480ac68759","sha512":"b3460e69163abc6e1da4cab1c57a60ab95802ebacc0fd9c3ef2a0c66661aa1b0021705d013b57de1d1912cffccd546d67db6f772f8ced2c469b941035e263f3d","ssdeep":"6144:zwWtenU5zaeS53AKWiQ9FsnLTRdwK8xCg9iBzueyHXPQTYCwHvj4KdSJcHdKIp1K:JeUQtAprULzp8xx9heYYTdqvj4juoIpc","ssdeep_chunks":["6144:zwWtenU","6144:wWtenU5","6144:WtenU5z","6144:tenU5za","6144:enU5zae","6144:nU5zaeS","6144:U5zaeS5","6144:5zaeS53","6144:zaeS53A","6144:aeS53AK","6144:eS53AKW","6144:S53AKWi","6144:53AKWiQ","6144:3AKWiQ9","6144:AKWiQ9F","6144:KWiQ9Fs","6144:WiQ9Fsn","6144:iQ9FsnL","6144:Q9FsnLT","6144:9FsnLTR","6144:FsnLTRd","6144:snLTRdw","6144:nLTRdwK","6144:LTRdwK8","6144:TRdwK8x","6144:RdwK8xC","6144:dwK8xCg","6144:wK8xCg9","6144:K8xCg9i","6144:8xCg9iB","6144:xCg9iBz","6144:Cg9iBzu","6144:g9iBzue","6144:9iBzuey","6144:iBzueyH","6144:BzueyHX","6144:zueyHXP","6144:ueyHXPQ","6144:eyHXPQT","6144:yHXPQTY","6144:HXPQTYC","6144:XPQTYCw","6144:PQTYCwH","6144:QTYCwHv","6144:TYCwHvj","6144:YCwHvj4","6144:CwHvj4K","6144:wHvj4Kd","6144:Hvj4KdS","6144:vj4KdSJ","6144:j4KdSJc","6144:4KdSJcH","6144:KdSJcHd","6144:dSJcHdK","6144:SJcHdKI","6144:JcHdKIp","6144:cHdKIp1","6144:HdKIp1K","12288:zwWtenU","12288:wWtenU5","12288:WtenU5z","12288:tenU5za","12288:enU5zae","12288:nU5zaeS","12288:U5zaeS5","12288:5zaeS53","12288:zaeS53A","12288:aeS53AK","12288:eS53AKW","12288:S53AKWi","12288:53AKWiQ","12288:3AKWiQ9","12288:AKWiQ9F","12288:KWiQ9Fs","12288:WiQ9Fsn","12288:iQ9FsnL","12288:Q9FsnLT","12288:9FsnLTR","12288:FsnLTRd","12288:snLTRdw","12288:nLTRdwK","12288:LTRdwK8","12288:TRdwK8x","12288:RdwK8xC","12288:dwK8xCg","12288:wK8xCg9","12288:K8xCg9i","12288:8xCg9iB","12288:xCg9iBz","12288:Cg9iBzu","12288:g9iBzue","12288:9iBzuey","12288:iBzueyH","12288:BzueyHX","12288:zueyHXP","12288:ueyHXPQ","12288:eyHXPQT","12288:yHXPQTY","12288:HXPQTYC","12288:XPQTYCw","12288:PQTYCwH","12288:QTYCwHv","12288:TYCwHvj","12288:YCwHvj4","12288:CwHvj4K","12288:wHvj4Kd","12288:Hvj4KdS","12288:vj4KdSJ","12288:j4KdSJc","12288:4KdSJcH","12288:KdSJcHd","12288:dSJcHdK","12288:SJcHdKI","12288:JcHdKIp","12288:cHdKIp1","12288:HdKIp1K","6144:JeUQtAp","6144:eUQtApr","6144:UQtAprU","6144:QtAprUL","6144:tAprULz","6144:AprULzp","6144:prULzp8","6144:rULzp8x","6144:ULzp8xx","6144:Lzp8xx9","6144:zp8xx9h","6144:p8xx9he","6144:8xx9heY","6144:xx9heYY","6144:x9heYYT","6144:9heYYTd","6144:heYYTdq","6144:eYYTdqv","6144:YYTdqvj","6144:YTdqvj4","6144:Tdqvj4j","6144:dqvj4ju","6144:qvj4juo","6144:vj4juoI","6144:j4juoIp","6144:4juoIpc"],"imphash":"Unknown"},"file_info":{"file_name":"esma50-165-2251_crypto_assets_and_financial_stability.pdf","file_type":["pdf"],"file_type_id":"pdf","file_size":553170,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1687366576000,"last_seen":1699580884000,"last_multi_scan":1699580884000}},"detections":{"summary":{"verdict":"malicious","score":40,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":30,"suspicious_count":5,"malicious_count":0,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Generik.FPOLTQH trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Spearphishing Link","attack_id":"T1566.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1566/002","identifiers":[{"type":"suspicious","value":"PDF file has an embedded URL to file"},{"type":"suspicious","value":"PDF file has an embedded URL referencing an URL shortener service"},{"type":"informative","value":"PDF file has an embedded URL"}],"sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains object with compressed stream data"}],"sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to copy files"}],"sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains ability to decrypt/decode data"}],"sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"}],"sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"\\+PsAesK+3\" (Indicator: \"Aes\"; File: \"esma50-165-2251_crypto_assets_and_financial_stability.pdf\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.882240664891667","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"level":"informative","category":"General","name":"Contains object with compressed stream data","description":"$27","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":10,"id":"static-66","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"https://www.ecb.europa.eu/pub/financial-stability/fsr/special/html/ecb.fsrart202205_02~1cc6b111b4.en.html?utm_source=twitter&utm_medium=social&utm_campaign=fsrmay2022_PR2#toc5\" (Indicator: \"twitter\"; File: \"esma50-165-2251_crypto_assets_and_financial_stability.pdf\")\n file/memory contains long string with (Indicator: \"twitter\"; File: \"esma50-165-2251_crypto_assets_and_financial_stability.pdf\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"esma50-165-2251_crypto_assets_and_financial_stability.pdf\" was detected as \"PDF\" and name: \"Format\"\n \"esma50-165-2251_crypto_assets_and_financial_stability.pdf\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"General","name":"PDF file has an embedded URL","description":"$28","origin":"File/Memory","mitre_attack_id":"T1566.002","relevance":3,"id":"string-25","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$29","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"A9Rlhho24_1u06xis_50o.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rlhho24_1u06xis_50o.tmp]\n \"A9Radrka3_1u06xiv_50o.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Radrka3_1u06xiv_50o.tmp]\n \"FAP50E7.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\FAP50E7.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: ce5f3254611a8c095a3d821d44539877\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"\\+PsAesK+3\" (Indicator: \"aes\"; File: \"esma50-165-2251_crypto_assets_and_financial_stability.pdf\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains embedded objects that might be interesting to investigate","description":"Embedded object type \"/ObjStm\" (ID: 185, References: )\n Embedded object type \"/ObjStm\" (ID: 705, References: )\n Embedded object type \"/ObjStm\" (ID: 1220, References: )","origin":"Static Parser","relevance":5,"id":"static-10","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"$2c","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$2d","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"suspicious","category":"Installation/Persistence","name":"PDF file has an embedded URL to file","description":"\"https://www.fsb.org/wp-content/uploads/r_091107c.pdf?page_moved=1\" references a file","origin":"File/Memory","mitre_attack_id":"T1566.002","relevance":10,"id":"string-41","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"Decrypt,\" (Source: screen_12.png, Indicator: \"decrypt\")","origin":"File/Memory","relevance":10,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PDF file has an embedded URL referencing an URL shortener service","description":"\"https://decrypt.co/101867/solana-plummets-double-digits-amid-another-network-halt\" contains URL shortener service \"t.co/\" (Based on: \"esma50-165-2251_crypto_assets_and_financial_stability.pdf\")\n \"https://help.ftx.com/hc/en-us/articles/360032509552-Leveraged-Token-Walkthrough-READ-THIS\" contains URL shortener service \"x.co\" (Based on: \"esma50-165-2251_crypto_assets_and_financial_stability.pdf\")","origin":"File/Memory","mitre_attack_id":"T1566.002","relevance":10,"id":"string-49","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"Found string \"try {XmlHttpObj1 = new ActiveXObject(\"Msxml2.XMLHTTP\");}\" (Indicator: \"msxml2.xmlhttp\"; File: \"urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752\")\n Found string \"catch(e) {try{XmlHttpObj1 = new ActiveXObject(\"Microsoft.XMLHTTP\");}\" (Indicator: \"microsoft.xmlhttp\"; File: \"urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-469","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/60 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"\n \"Local\\Acrobat Instance Mutex\"\n \"com.adobe.acrobat.rna.RdrCefBrowserLock.DC\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlref_httpswww.fsb.orgwp-contentuploadsr_091107c.pdfpage_moved_1\" as clean (type is \"PDF document version 1.6\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"RdrCEF.exe\" (UID: 00000000-00002892) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"RdrCEF.exe\" with commandline \"--backgroundcolor=16448250\" (UID: 00000000-00002892)\n Spawned process \"RdrCEF.exe\" with commandline \"--backgroundcolor=16448250\" (UID: 00000000-00003856)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=FEABAE347262F26F55EC3902 ...\" (UID: 00000000-00002940)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=8534836A86C6502C05BF4409 ...\" (UID: 00000000-00003664)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"Copy URL\" (Indicator: \"\"copy \") in Source: urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752\n Observed string: \"Copy DOI\" (Indicator: \"\"copy \") in Source: urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"/* Cleaning the password text*/\" (Indicator: \"password\"; File: \"urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752\")\n Found string \"$('.password-inp').bind(\"change keyup input\",function() {\" (Indicator: \"password\"; File: \"urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752\")\n Found string \"$('.password-inp').keypress(function(event) {\" (Indicator: \"password\"; File: \"urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-Default\"; File: \"urlref_httpswww.mfsa.mtour-workvirtual-financial-assets\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; File: \"urlref_httpswww.mfsa.mtour-workvirtual-financial-assets\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"67.218.111.202\" found in string \"var strIP = \"67.218.111.202\";\"\n Potential IP \"67.218.111.202\" found in string \"var remoteIpAddr=\"67.218.111.202\";;\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":181,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":18,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":25,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"66543162ec833a19aa0aff8e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":40,"submit_name":"esma50-165-2251_crypto_assets_and_financial_stability.pdf","analysis_start_time":"2024-05-27T07:08:19+00:00","indicators_count":{"informative":18,"suspicious":3,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"64932baf77a9f942340a41fb","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"esma50-165-2251_crypto_assets_and_financial_stability.pdf","analysis_start_time":"2023-06-21T16:56:16+00:00","indicators_count":{"informative":25,"suspicious":6,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}],"processes":[{"pid":3912,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\esma50-165-2251_crypto_assets_and_financial_stability.pdf\"","sha256":"2e9b9635469ff056f09023f7d671120d0c0f86f30767b06daa545c01242bcbef","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","uid":"00000000-00003912","icon":"$31"},{"pid":2892,"ppid":3912,"name":"RdrCEF.exe","command_line":"--backgroundcolor=16448250","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00000000-00003912","uid":"00000000-00002892"},{"pid":2940,"ppid":2892,"name":"RdrCEF.exe","command_line":"$32","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00000000-00002892","uid":"00000000-00002940"},{"pid":3664,"ppid":2892,"name":"RdrCEF.exe","command_line":"$33","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00000000-00002892","uid":"00000000-00003664"},{"pid":3856,"ppid":3912,"name":"RdrCEF.exe","command_line":"--backgroundcolor=16448250","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00000000-00003912","uid":"00000000-00003856"}],"all_imported_dlls":["ccme_base_non_fips.dll","BIB.dll","bcryptprimitives.dll","twinapi.appcore.dll","wkscli.dll","SensApi.dll","nsi.dll","ws2_32.dll","apphelp.dll","SHCore.dll","mpr.dll","d3d11.dll","dxgi.dll","cryptsp.dll","avrt.dll","profapi.dll","ninput.dll","rmclient.dll","ccme_base.dll","psapi.dll","winmm.dll","IPHLPAPI.DLL","AdobeXMP.dll","secur32.dll","dnsapi.dll","version.dll","MMDevAPI.dll","TextInputFramework.dll","shell32.dll","windows.storage.dll","powrprof.dll","rasadhlp.dll","wow64cpu.dll","shlwapi.dll","mscms.dll","devobj.dll","CoreUIComponents.dll","winmmbase.dll","imm32.dll","AXSLE.dll","WindowsCodecs.dll","ccme_ecc.dll","wow64.dll","gdi32.dll","AcroRd32.dll","netapi32.dll","wsock32.dll","mswsock.dll","ccme_asym.dll","samcli.dll","dwmapi.dll","AGM.dll","dcomp.dll","sqlite.dll","coml2.dll","wow64win.dll","iertutil.dll","GdiPlus.dll","netutils.dll","winnsi.dll","kernel32.dll","user32.dll","sechost.dll","combase.dll","cfgmgr32.dll","userenv.dll","ksuser.dll","msvcrt.dll","bcrypt.dll","msvcp100.dll","ntmarta.dll","AXE8SharedExpat.dll","NPSWF32.dll","wininet.dll","aepic.dll","ole32.dll","WinTypes.dll","advapi32.dll","urlmon.dll","clbcatq.dll","dsound.dll","ntdll.dll","cryptbase.dll","DataExchange.dll","thumbcache.dll","fltLib.dll","winhttp.dll","AcGenral.dll","rpcrt4.dll","oleaut32.dll","msacm32.dll","msasn1.dll","dpapi.dll","msimg32.dll","cryptocme.dll","CoreMessaging.dll","ACE.dll","comdlg32.dll","ieframe.dll","msvcp_win.dll","win32u.dll","crypt32.dll","BIBUtils.dll","cldapi.dll","sspicli.dll","ucrtbase.dll","kernel.appcore.dll","uxtheme.dll","msvcr100.dll","propsys.dll","OnDemandConnRouteHelper.dll","FWPUCLNT.DLL","mlang.dll","schannel.dll","KernelBase.dll","comctl32.dll","rsaenh.dll","ccme_ecdrbg.dll","gpapi.dll","msctf.dll","CoolType.dll","gdi32full.dll","imagehlp.dll","msvcp120.dll","AcroRd32Res.dll","api-ms-win-downlevel-version-l1-1-0.dll","libcef.dll","credui.dll","msvcr120.dll","ncrypt.dll","wship6.dll","dxva2.dll","wshqos.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wlanapi.dll","setupapi.dll","hid.dll","rpcss.dll","api-ms-win-downlevel-user32-l1-1-0.dll","DWrite.dll","icudt.dll","dhcpcsvc6.dll","npmproxy.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wintrust.dll","wevtapi.dll","WSHTCPIP.DLL","tzres.dll","Wldap32.dll","dbghelp.dll","dui70.dll","lpk.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","nlaapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","dhcpcsvc.dll","WSDApi.dll","srvcli.dll","duser.dll","netprofm.dll","d3d9.dll","AudioSes.dll","d3d8thk.dll","webio.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","oleacc.dll","wtsapi32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","chrome_elf.dll","usp10.dll","RpcRtRemote.dll","wlanutil.dll","ExplorerFrame.dll","api-ms-win-core-synch-l1-2-0.dll","VxSSL32.dll","oleaccrc.dll","normaliz.dll","cryptui.dll","KBDUS.DLL","credssp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Annss.dat","sha256":"8b80caa865ad909f33b4d9c5f6a8a962b203687560190bea6b1d4e8197cf30ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"name":"Annssi.dat","sha256":"dbfbc3da1614dccaf33a011c9960615a5bcb195ef77920f386df58a71f5d0cef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"name":"Annssk.dat","sha256":"7e30067188784fe4137716226897cdcc1ba475f0a010ef27d5bb80c54ca92190","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"addressbook.acrodata","sha256":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"name":"A9Radrka3_1u06xiv_50o.tmp","sha256":"0e07cc568c6a9039584d1f267d6a2eb4cce1c83e27b79b588bd6406e6eb4772b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"name":"A9Rlhho24_1u06xis_50o.tmp","sha256":"5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"name":"FAP50E7.tmp","sha256":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"name":"urlref_httpswww.theblock.codatadecentralized-financeexploits","sha256":"419d957d8caf93b917727a8d4fb8b4b5c5d76579c22c172690d2bbd6ea9a61ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"urlref_httpswww.fsb.orgwp-contentuploadsr_091107c.pdfpage_moved_1","sha256":"14e3ef4afbbe1f2c4367a11dd8b69f08ac3c846389b48f8b9cb5eacc92ffceb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"urlref_httpswww.mfsa.mtour-workvirtual-financial-assets","sha256":"b6394678d3f468e2ca7bd22e859a12f669c4ba09e4762600f1d8dca4521219f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"urlref_httpspapers.ssrn.comsol3papers.cfmabstract_id_3888752","sha256":"8e79b551cb01ea3d949964915ae45fd623d6658ccf0b350137b116b5628ddfce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"urlref_httpswww.esma.europa.eupress-newsesma-newseu-financial-regulators-warn-consumers-risks-crypto-assets#~text_EU%20financial%20regu","sha256":"179be77e6465c26f9508c15910f1a64c113c57b16e48047f08c6957140071c4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"data_1","sha256":"ead7542ff1d29fa37d785b314273104dd7d40ff558cc4a9ea90ba6dd1a8ed597","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"Visited Links","sha256":"9d1c9dc432b2e97f7a54b4da2724e4ff96dc719e60cb89c9f82dbec9226856c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"A9Rbcz4le_1qrvzv1_30o.tmp","sha256":"42a850147cf596396bede5dab89e19580c09b58b610ece5e525b37618b4826d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"path":"%TEMP%\\FAP50E7.tmp","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"},{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"pipe\\com.adobe.reader.rna.ecLKuqb.DC.0","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"%USERPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"66543162ec833a19aa0aff8e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKLMHKLM\\SOFTWARE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\CHROMIUM\\\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\CHROMIUM\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]},{"name":"com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"64932baf77a9f942340a41fb"}]}]}},"report_ids":{"sandbox_job_ids":["66543162ec833a19aa0aff8e","64932baf77a9f942340a41fb"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Generik.FPOLTQH trojan Sample 4f6690b82ca4… — Score 40/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4f6690b82ca4…. Malware family: Generik.FPOLTQH trojan. Threat score 40/100. 0/28 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4f6690b82ca4b1f5735386729c4a04161e2cda9443cab700279eb583d9d21f70"}],["$","meta","4",{"property":"og:title","content":"Malicious Generik.FPOLTQH trojan Sample 4f6690b82ca4… — Score 40/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4f6690b82ca4…. Malware family: Generik.FPOLTQH trojan. Threat score 40/100. 0/28 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4f6690b82ca4b1f5735386729c4a04161e2cda9443cab700279eb583d9d21f70"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Generik.FPOLTQH trojan Sample 4f6690b82ca4… — Score 40/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4f6690b82ca4…. Malware family: Generik.FPOLTQH trojan. Threat score 40/100. 0/28 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]