25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:T18d0,Object ID 2271 contains compressed stream data: \x00\x00\x00\x03\x00\x00\x12\xae\x00\x06\x00\x00\x01\x8b\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x06\x00?\x00\x04\x00\x08\xa0\x00\x00\x00 \x10\x18\x00\x00\x00\x00\x00\x00\x00\x01\x08P\x00\x04\x10\x83?0\x00\x00\x10\x01\x08\x10@\x04\x10\x ... Object ID 2239 contains compressed stream data: q 0.1 0 0 0.1 0 0 cm /R296 gs /R298 cs 0.291992 0.689453 0.833984 scn 0 0 4394.28 6831.49 re f q 0 0 4394 6832 re W n 3912.4 6831.49 m 3912.4 4691.34 l 3940.76 4691.34 l 3940.76 4681.34 l 3912.4 4681.34 l 3912.4 2820.47 l 4394.28 2820.47 l 4394.28 6831.49 ... Object ID 2240 contains compressed stream data: W n q 3662.93 0 0 17.568 252.621 4677.21 cm /R310 Do Q Q q 245.719 467.711 10 2352.76 re W n q 24 0 0 -2366.4 238.999 2827.2 cm BI /CS/R311 /W 5 /H 493 /BPC 8 /F/Fl ID x\x9c\xed\xc1\x07S\x08`\x00\xc7\xe1\xec\xaddd7d\x84\x08\xd9\xa3]FDF(\x92\x14\xb2\xf7\x96 ..., Object ID 2241 contains compressed stream data: 3099.45 592.086 3097.05 594.887 3093.45 594.887 c 3091.86 594.484 l 3089.45 602.887 3086.25 610.887 3082.25 618.086 c 3084.25 618.887 3085.45 620.887 3085.45 623.285 c 3085.45 626.484 3082.65 629.285 3079.05 629.285 c 3076.25 628.484 l 3071.05 635.684 3065 ..., Object ID 2242 contains compressed stream data: 2925.05 529.285 l 2925.05 548.887 l 2921.45 551.285 l 2905.86 538.086 l 2891.86 554.887 l 2929.05 606.086 l 2935.05 623.285 l 2956.25 630.484 l 2953.05 639.684 l 2959.86 649.684 l 2957.05 669.285 l 2963.05 666.484 2967.45 662.484 2967.45 652.484 c 2978.25 ..., Object ID 2243 contains compressed stream data: 3813.84 568.484 3790.23 544.086 3790.23 512.887 c 3790.23 487.285 3806.63 465.684 3835.04 465.684 c 3842.23 465.684 3857.84 469.684 3871.04 486.086 c 3865.84 493.285 l 3857.84 485.285 3851.43 482.887 3842.63 482.887 c 3827.04 482.887 3811.43 494.086 3810.6 ..., Object ID 2244 contains compressed stream data: 3716.63 504.484 3707.84 516.484 3707.84 533.285 c 3707.84 550.086 3717.43 558.887 3725.84 558.887 c 3738.23 558.887 3745.84 546.086 3745.84 530.484 c 3762.23 438.484 m 3762.23 425.285 3751.04 412.086 3731.04 412.086 c 3713.04 412.086 3701.04 422.484 3701.0 ..., Object ID 2246 contains compressed stream data: \x01\x00\x04\x02\x00\x01\x01\x01\x1bVxvphkDhwnjvMyriadPro-Cond\x00\x01\x01\x011\xf8\x1b\x01\xf8\x1c\x02\xf8\x1d\x03\x8b\xfbh\xf8\x88\xf9P\x05\x1d\x00\x0fB@\x1d;\x8f\x8f\xaa\x0e\x8b?\x03\x8b?\x04\xdf\x1c\x07\xf5\x12\xf8?\x11\xf8\x12\x0f\xf7\xfa\x10\x00\x03\ ..., Object ID 2250 contains compressed stream data: 3521.43 565.285 3509.04 562.484 3496.63 560.086 c 3496.63 553.285 l 3509.84 551.684 3511.04 551.684 3511.04 536.086 c 3511.04 492.887 l 3511.04 478.484 3509.04 477.285 3495.43 476.086 c 3495.43 468.086 l h 3485.04 556.086 m 3485.04 562.484 3479.43 568.484 ..., Object ID 2251 contains compressed stream data: 3325.43 546.086 l 3330.63 549.285 3339.04 553.684 3345.43 553.684 c 3360.63 553.684 3372.63 542.484 3372.63 517.285 c 3278.63 508.484 m 3278.63 558.086 3209.04 550.086 3209.04 588.086 c 3209.04 600.484 3216.63 610.887 3231.84 610.887 c 3252.23 610.887 3258 ..., Object ID 2252 contains compressed stream data: \x01\x00\x04\x02\x00\x01\x01\x01#VcypgwLxtrvwMyriadPro-SemiboldCond\x00\x01\x01\x016\xf8\x1b\x01\xf8\x1c\x02\xf8\x1d\x03\x8b\xfbj\xf8\x88\xf9P\x05\x1d\x00\x0fB@\x1d\x00\x00\xae\xd7\x1d;\x8f\x8f\xa8\x0e\x8b?\x03\x8b?\x04\xdf\x1c\x07\xfa\x12\xf8\x11\x11\xf7\ ..., Object ID 2253 contains compressed stream data: \x00\x00 \x10\x00\x00\x00\x00\x02\x10\x00\x00mntrRGB XYZ \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00acspAPPL\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\xd6\x00\x01\x00\x00\x00\x00\xd3-\x ..., Object ID 2255 contains compressed stream data: K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb0\xd4K\xb ..., Object ID 2259 contains compressed stream data: \x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02\x16C\x02 ..., Object ID 2263 contains compressed stream data: Unsupported filter: ['/DCTDecode'], Object ID 2264 contains compressed stream data: Unsupported filter: ['/DCTDecode'], Object ID 2265 contains compressed stream data: Unsupported filter: ['/DCTDecode'], Object ID 2266 contains compressed stream data: Unsupported filter: ['/DCTDecode'], Object ID 2267 contains compressed stream data: \xf8\xf8\xf8\xf8\xf8\xf8\xf8\xf8\xf8\xf8\xf8\xf8\xf8\xf8\xf8\xf8\xe7\xe7\xf1\xe7\xe7\xf1\xf1\xf1\xf2\xf2\xf2\xea\xea\xea\xea\xea\xea\xea\xea\xea\xea\xea\xea\xf2\xd3\xea\xd3\xd2\xd3\xd3\xd4\xd4\xd3\xd4\xd4\xd4\xd4\xd4\xd4\xd2\xd3\xd7\xd7\xd4\xd4\xd4\xd5\x9b ..., Object ID 2268 contains compressed stream data: Unsupported filter: ['/DCTDecode'], Object ID 2269 contains compressed stream data: \x01\x02\x16C\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x16C\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x16C\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x16C\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x16 ..., Object ID 2270 contains compressed stream data: Unsupported filter: ['/DCTDecode'], Object ID 3 contains compressed stream data: q 0.1 0 0 0.1 0 0 cm /R331 gs /R298 cs 0 0 0 scn q 10 0 0 10 0 0 cm BT -0.00159403 Tc /R332 15.9403 Tf 1 0 0 1 53.8582 593.234 Tm [(Springer)-280.2(Undergraduate)-281.409(Texts)-279.605(in)-276.711(Philosophy)]TJ ET Q /R334 gs Q Object ID 6 contains compressed stream data: q 0.1 0 0 0.1 0 0 cm /R331 gs /R298 cs 0 0 0 scn q 10 0 0 10 0 0 cm BT /R341 9.9626 Tf 1 0 0 1 53.8582 597.146 Tm [(The)-323(Springer)-327.018(Undergradua)-10.0094(te)-319.002(Texts)-327.986(in)-317.013(Philosoph)-6.99883(y)-319(offers)-320.988(a)-320.991( ..., Object ID 9 contains compressed stream data: q 0.1 0 0 0.1 0 0 cm /R331 gs /R298 cs 0 0 0 scn q 10 0 0 10 0 0 cm BT /R341 15.9403 Tf 1 0 0 1 53.8582 593.008 Tm (Lars-G)Tj /R351 15.9403 Tf 45.127 0.454297 Td (\x80)Tj /R341 15.9403 Tf 0.454297 TL T*[(oran)-279.295(Johansson)]TJ 0.0055791 Tc /R341 27.89 ...27:Ta62,"http://dx.doi.org/10.1007/978-3-319-26551-3_BM1" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "https://ebooks.adelaide.edu.au/a/aristotle" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://classics.mit.edu/Hippocrates/sacred.html" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "https://ebooks.adelaide.edu.au/a" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://classics.mit.edu/Confucius" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://www.complex-systems.com/pdf/14-3-5.pdf" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://www.indiana.edu/%7Ep374" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://www.gutenberg.org/ebooks/1726" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://classics.mit.edu/Hippocra" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://philsci-archive.pitt.edu/878/1/PSA2002.pdf" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://plato.stanford.edu" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://plato.stanford.edu/entries/functionalism" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://dx.doi.org/10.1007/978-3-319-26551-3_13" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://arxiv.org/abs/0907.0455" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://dx.doi.org/10.1007/978-3-319-26551-3_14" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://www.apa.org/ethics/code/principles.pdf" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://dx.doi.org/10.1007/978-3-319-26551-3_11" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "https://ebooks.adelaide.edu.au/a/aristotle/a8poa/index.html" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://dx.doi.org/10.1007/978-3-319-26551-3_12" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://classics.mit.edu/Confucius/analects.3.3.html" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "philsci-archive.pitt.edu/878/1/PSA2002.pdf" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://dx.doi.org/10.1007/978-3-319-26551-3_9" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://dx.doi.org/10.1007/978-3-319-26551-3_8" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "https://ebooks.adelaide.edu.au/k/kant/immanuel/k16p/index.html" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf") "http://classics.mit.edu/Thucydides/pelopwar.2.second.html" (Based on: "2016_Book_PhilosophyOfScienceForScientis.pdf")28:Tb50,"urlref_httpphilsci-archive.pitt.edu8781PSA2002.pdf" has type "PDF document version 1.4"- [targetUID: 00000000-00007808] "urlref_httpplato.stanford.eduentriesfunctionalism" has type "HTML document ASCII text"- [targetUID: 00000000-00007808] "AdobeFnt14.lst.7808" has type "PostScript document text"- [targetUID: 00000000-00007808] "urlref_httpwww.complex-systems.compdf14-3-5.pdf" has type "PDF document version 1.3"- [targetUID: 00000000-00007808] "A9R9qqzul_1aokikm_60w.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9R9qqzul_1aokikm_60w.tmp]- [targetUID: 00000000-00007808] "urlref_httpclassics.mit.eduHippocratessacred.html" has type "HTML document ASCII text with very long lines"- [targetUID: 00000000-00007808] "A9Rt6gspd_1aokikl_60w.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rt6gspd_1aokikl_60w.tmp]- [targetUID: 00000000-00007808] "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00007808] "A9Ryexeli_1aokiko_60w.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Ryexeli_1aokiko_60w.tmp]- [targetUID: 00000000-00007808] "Annssi.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00007808] "A9Rkx4ggy_1aokikj_60w.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rkx4ggy_1aokikj_60w.tmp]- [targetUID: 00000000-00007808] "Annss.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00007808] "addressbook.acrodata" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00007808] "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00007808] "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00007808] "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00007808] "Annssk.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00007808] "FAPE4AA.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\FAPE4AA.tmp]- [targetUID: 00000000-00007808] "A9Rnrl8ng_1aokikk_60w.tmp" has type "data"- Location: [%TEMP%\A9Rnrl8ng_1aokikk_60w.tmp]- [targetUID: 00000000-00007808]29:Te87,Pattern match: "http://www.springer.com/series/13798" Pattern match: "www.springer.com" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_BM1" Pattern match: "https://ebooks.adelaide.edu.au/a/aristotle" Pattern match: "http://classics.mit.edu/Hippocrates/sacred.html" Pattern match: "https://ebooks.adelaide.edu.au/a" Pattern match: "http://classics.mit.edu/Confucius" Pattern match: "http://www.complex-systems.com/pdf/14-3-5.pdf" Pattern match: "http://www.indiana.edu/%7Ep374" Pattern match: "http://www.gutenberg.org/ebooks/1726" Pattern match: "http://classics.mit.edu/Hippocra" Pattern match: "http://philsci-archive.pitt.edu/878/1/PSA2002.pdf" Pattern match: "http://plato.stanford.edu" Pattern match: "http://plato.stanford.edu/entries/functionalism" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_13" Pattern match: "http://arxiv.org/abs/0907.0455" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_14" Pattern match: "http://www.apa.org/ethics/code/principles.pdf" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_11" Pattern match: "https://ebooks.adelaide.edu.au/a/aristotle/a8poa/index.html" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_12" Pattern match: "http://classics.mit.edu/Confucius/analects.3.3.html" Pattern match: "philsci-archive.pitt.edu/878/1/PSA2002.pdf" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_9" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_8" Pattern match: "https://ebooks.adelaide.edu.au/k/kant/immanuel/k16p/index.html" Pattern match: "http://classics.mit.edu/Thucydides/pelopwar.2.second.html" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_10" Pattern match: "http://www.indiana.edu/%7Ep374/Analects_of_Confucius_(Eno-2015).pdf" Pattern match: "http://delawaretribe.org/blog/2013/06/26/faqs/#Living" Heuristic match: "springer.com" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_7" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_6" Pattern match: "http://classics.mit.edu/Confucius/analects.html" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_5" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_4" Pattern match: "https://ebooks.adelaide.edu.au/a/aristotle/metaphysics" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_3" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_2" Pattern match: "http://dx.doi.org/10.1007/978-3-319-26551-3_1" Pattern match: "https://ebooks.adelaide" Heuristic match: "z9.eT" Heuristic match: "m+n.pY" Heuristic match: "^Vw4jBC(k.gN" Heuristic match: "di.vU" Heuristic match: "QI\" (Indicator: \"text/javascript\"; File: \"urlref_httpplato.stanford.eduentriesfunctionalism\")\n Found string \"\" (Indicator: \"text/javascript\"; File: \"urlref_httpplato.stanford.eduentriesfunctionalism\")\n Found string \"\" (Indicator: \"text/javascript\"; File: \"urlref_httpplato.stanford.eduentriesfunctionalism\")\n Found string \"\" (Indicator: \"text/javascript\"; File: \"urlref_httpplato.stanford.eduentriesfunctionalism\")\n Found string \"\" (Indicator: \"text/javascript\"; File: \"urlref_httpplato.stanford.eduentriesfunctionalism\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$28","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"A9R9qqzul_1aokikm_60w.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9R9qqzul_1aokikm_60w.tmp]\n \"A9Rt6gspd_1aokikl_60w.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rt6gspd_1aokikl_60w.tmp]\n \"A9Ryexeli_1aokiko_60w.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Ryexeli_1aokiko_60w.tmp]\n \"A9Rkx4ggy_1aokikj_60w.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rkx4ggy_1aokikj_60w.tmp]\n \"FAPE4AA.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\FAPE4AA.tmp]\n \"A9Rnrl8ng_1aokikk_60w.tmp\" has type \"data\" - Location: [%TEMP%\\A9Rnrl8ng_1aokikk_60w.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"urlref_httpplato.stanford.eduentriesfunctionalism\")\n Found string \"\" (Indicator: \".googleapis.com\"; File: \"urlref_httpplato.stanford.eduentriesfunctionalism\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"

Deroy, O. (ed.), 2017, Sensory Blending: On Synaesthesia and\" (Indicator: \"aes\"; File: \"urlref_httpplato.stanford.eduentriesfunctionalism\")\n Found string \"of Synaesthesia for Functionalism”, Journal of Consciousness\" (Indicator: \"aes\"; File: \"urlref_httpplato.stanford.eduentriesfunctionalism\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"nor less than what is proper be secreted from it, the head is thus in the\" (Indicator: \"secret\"; File: \"urlref_httpclassics.mit.eduHippocratessacred.html\")\n Found string \"most healthy condition. If the secretion (melting) the from the brain be\" (Indicator: \"secret\"; File: \"urlref_httpclassics.mit.eduHippocratessacred.html\")\n Found string \"contracted, while the most morbid and humid is secreted, and overflows\" (Indicator: \"secret\"; File: \"urlref_httpclassics.mit.eduHippocratessacred.html\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$2a","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"classics@classics.mit.edu\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"PDF file has an embedded URL to file","description":"\"http://www.complex-systems.com/pdf/14-3-5.pdf\" references a file\n \"http://philsci-archive.pitt.edu/878/1/PSA2002.pdf\" references a file","origin":"File/Memory","mitre_attack_id":"T1566.002","relevance":10,"id":"string-41","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"Local\\Acrobat Instance Mutex\"\n \"DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\com.adobe.acrobat.rna.RdrCefBrowserLock.DC\"\n \"com.adobe.acrobat.rna.RdrCefBrowserLock.DC\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"RdrCEF.exe\" (UID: 00000000-00005108) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"RdrCEF.exe\" with commandline \"--backgroundcolor=16448250\" (UID: 00000000-00005108)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=73A2E3B9B3199E27D9D7949A ...\" (UID: 00000000-00005572)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=430E6EE04862F77009D4A269 ...\" (UID: 00000000-00005692)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":181,"dropped_files_count":0,"extracted_files_count":24,"files_written_count":33,"files_deleted_count":0,"registry_keys_created_count":23,"registry_keys_modified_count":0,"registry_keys_deleted_count":8,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":31,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"653cb201cee20a6cb40f144b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"2016_Book_PhilosophyOfScienceForScientis.pdf","analysis_start_time":"2023-10-28T07:02:25+00:00","indicators_count":{"informative":18,"suspicious":2,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"653cb1d884f7f29fad042674","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"no specific threat","submit_name":"2016_Book_PhilosophyOfScienceForScientis.pdf","analysis_start_time":"2023-10-28T07:01:45+00:00","indicators_count":{"informative":19,"suspicious":2,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"653cb1812185b372f801d5f6","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"2016_Book_PhilosophyOfScienceForScientis.pdf","analysis_start_time":"2023-10-28T07:00:17+00:00","indicators_count":{"informative":19,"suspicious":2,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"653cb1137111c4b12c070158","environment_id":400,"environment_description":"Mac Catalina 64 bit (x86)","state":"ERROR","error_type":"File \"2016_Book_PhilosophyOfScienceForScientis.pdf\" was detected as \"pdf\", this format is not supported on MACOSX","verdict":"undetected","submit_name":"2016_Book_PhilosophyOfScienceForScientis.pdf","analysis_start_time":"2023-10-28T06:58:27+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}],"processes":[{"pid":4960,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\2016_Book_PhilosophyOfScienceForScientis.pdf\"","sha256":"2e9b9635469ff056f09023f7d671120d0c0f86f30767b06daa545c01242bcbef","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","uid":"00000000-00004960","icon":"$2c"},{"pid":5108,"ppid":4960,"name":"RdrCEF.exe","command_line":"--backgroundcolor=16448250","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00000000-00004960","uid":"00000000-00005108"},{"pid":5572,"ppid":5108,"name":"RdrCEF.exe","command_line":"$2d","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00000000-00005108","uid":"00000000-00005572"},{"pid":5692,"ppid":5108,"name":"RdrCEF.exe","command_line":"$2e","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00000000-00005108","uid":"00000000-00005692"}],"all_imported_dlls":["mpr.dll","ntmarta.dll","BIBUtils.dll","nsi.dll","advapi32.dll","dwmapi.dll","imm32.dll","msvcp100.dll","crypt32.dll","GdiPlus.dll","winhttp.dll","sechost.dll","sspicli.dll","samcli.dll","d3d11.dll","wkscli.dll","version.dll","AGM.dll","propsys.dll","rpcrt4.dll","msasn1.dll","OnDemandConnRouteHelper.dll","FWPUCLNT.DLL","winmm.dll","SensApi.dll","WindowsCodecs.dll","ccme_base.dll","msvcrt.dll","ole32.dll","ACE.dll","ksuser.dll","winnsi.dll","shell32.dll","bcrypt.dll","msctf.dll","clbcatq.dll","dsound.dll","MMDevAPI.dll","psapi.dll","dnsapi.dll","TextInputFramework.dll","apphelp.dll","msvcp_win.dll","netutils.dll","ccme_ecdrbg.dll","gdi32.dll","powrprof.dll","uxtheme.dll","dpapi.dll","cldapi.dll","ieframe.dll","DataExchange.dll","combase.dll","SHCore.dll","cryptsp.dll","comdlg32.dll","userenv.dll","NPSWF32.dll","schannel.dll","kernel32.dll","coml2.dll","BIB.dll","windows.storage.dll","profapi.dll","dcomp.dll","ntdll.dll","user32.dll","rmclient.dll","mscms.dll","AXSLE.dll","rasadhlp.dll","kernel.appcore.dll","AcGenral.dll","fltLib.dll","mlang.dll","msimg32.dll","KernelBase.dll","ucrtbase.dll","msacm32.dll","winmmbase.dll","ninput.dll","wow64cpu.dll","gdi32full.dll","urlmon.dll","twinapi.appcore.dll","mswsock.dll","IPHLPAPI.DLL","comctl32.dll","ccme_ecc.dll","wsock32.dll","cryptocme.dll","wow64.dll","wow64win.dll","cryptbase.dll","oleaut32.dll","dxgi.dll","sqlite.dll","win32u.dll","AdobeXMP.dll","netapi32.dll","devobj.dll","WinTypes.dll","msvcr100.dll","bcryptprimitives.dll","rsaenh.dll","aepic.dll","wininet.dll","avrt.dll","thumbcache.dll","CoreMessaging.dll","shlwapi.dll","cfgmgr32.dll","imagehlp.dll","AXE8SharedExpat.dll","ws2_32.dll","secur32.dll","ccme_base_non_fips.dll","gpapi.dll","AcroRd32.dll","ccme_asym.dll","iertutil.dll","CoolType.dll","CoreUIComponents.dll","rpcss.dll","duser.dll","npmproxy.dll","d3d9.dll","wshqos.dll","VxSSL32.dll","oleaccrc.dll","wlanapi.dll","msvcr120.dll","netprofm.dll","icudt.dll","AcroRd32Res.dll","Wldap32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","dxva2.dll","AudioSes.dll","msvcp120.dll","tzres.dll","lpk.dll","ExplorerFrame.dll","hid.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","webio.dll","WSDApi.dll","chrome_elf.dll","DWrite.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","libcef.dll","ncrypt.dll","KBDUS.DLL","d3d8thk.dll","credssp.dll","dhcpcsvc6.dll","api-ms-win-core-synch-l1-2-0.dll","dbghelp.dll","srvcli.dll","wtsapi32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","oleacc.dll","RpcRtRemote.dll","dui70.dll","wintrust.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wship6.dll","credui.dll","wevtapi.dll","setupapi.dll","cryptui.dll","api-ms-win-downlevel-version-l1-1-0.dll","nlaapi.dll","dhcpcsvc.dll","usp10.dll","WSHTCPIP.DLL","wlanutil.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_httpwww.complex-systems.compdf14-3-5.pdf","sha256":"02f03c94e1663995675c2b576526fb6e765d7706dffeb44dc7163dc2600b418f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"A9Rnrl8ng_1aokikk_60w.tmp","sha256":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"Annss.dat","sha256":"60fe3ef58e5a4536f5b5f3e5cd8ef390a03ec532139aa6438da188e835f0255a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"Annssi.dat","sha256":"e3e2b3bde804faae2572f76a0722a09a63c9c5860dde48aef2ec8fc53b5df932","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"Annssk.dat","sha256":"65c4c7efc59b8dedcabcc54a3a80cc2f9bc1f622866eded0a0ca773d8d5907c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"addressbook.acrodata","sha256":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"A9R9qqzul_1aokikm_60w.tmp","sha256":"fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"A9Rkx4ggy_1aokikj_60w.tmp","sha256":"b572c39b15d22f892554f5568a1586b589876c3fcdaa84c5477724b6fd3ef8cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"A9Rt6gspd_1aokikl_60w.tmp","sha256":"5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"A9Ryexeli_1aokiko_60w.tmp","sha256":"0e07cc568c6a9039584d1f267d6a2eb4cce1c83e27b79b588bd6406e6eb4772b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"FAPE4AA.tmp","sha256":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"urlref_httpphilsci-archive.pitt.edu8781PSA2002.pdf","sha256":"d1b5a50498304669ae0b817db10cd8b9614c661d6af7dc53bd3491b5956d9e51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"urlref_httpplato.stanford.eduentriesfunctionalism","sha256":"a34973e3438833d570d056ca5f4b0b4b383340f695c0c42de2b4da3a65541c9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"AdobeFnt14.lst.7808","sha256":"757fda8727d14bcb30b296989e87397fdb09fc405ac7ebd013aecafd85596442","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"name":"urlref_httpclassics.mit.eduHippocratessacred.html","sha256":"b59c2ae1275ad425af3daead1c3a6290983f1a2cbbd09c7435a84683d9468aea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"GlobSettings","sha256":"7c22c759ca704106556bbc4fc10b7f53404ca1f8b40f01038d3f7c4b8183f486","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"data_1","sha256":"661ef29915bec72c70d0e6a952ae056e05c4288c3d5598902e51192055c03daf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"Visited Links","sha256":"9d1c9dc432b2e97f7a54b4da2724e4ff96dc719e60cb89c9f82dbec9226856c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"IconCacheRdr65536.dat","sha256":"2c8a3dfc32581e2442370b9af2bd4ada4cd5824778628e7063545a329aed063e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"name":"A9R4rmfzf_14e58it_2w0.tmp","sha256":"42a850147cf596396bede5dab89e19580c09b58b610ece5e525b37618b4826d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%USERPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\assets\\assets-231028140524Z-33037","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\assets\\assets-231028140524Z-33045","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\assets\\assets-231028140524Z-33048","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%SAMPLEDIR%\\ProgramData","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\assets\\assets-231028140524Z-33052","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"},{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"path":"pipe\\com.adobe.reader.rna.MqcXS8j.DC.0","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"path":"pipe\\com.adobe.reader.rna.zwD9jBU.DC.0","sources":[{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F36A9B55-A9CC-411C-BE14-E7420074BE63}","sources":[{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"key":"HKCUHKCU\\SOFTWARE\\ADOBE\\ACROBAT READER\\11.0\\EXITSECTION\\","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{373D8821-1250-4ED8-B13F-9E071BA7469A}\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{373D8821-1250-4ED8-B13F-9E071BA7469A}\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKLMHKLM\\SOFTWARE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKCUHKCU\\SOFTWARE\\ADOBE\\ACROBAT READER\\DC\\EXITSECTION\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"key":"HKCUHKCU\\SOFTWARE\\CHROMIUM\\\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"key":"HKCUHKCU\\SOFTWARE\\CHROMIUM\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"653cb201cee20a6cb40f144b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{373D8821-1250-4ED8-B13F-9E071BA7469A}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-10-DB-FF-DC-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]},{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]},{"name":"com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"653cb1d884f7f29fad042674"},{"report_type":"sandbox","report_id":"653cb1812185b372f801d5f6"}]}]}},"report_ids":{"sandbox_job_ids":["653cb201cee20a6cb40f144b","653cb1d884f7f29fad042674","653cb1812185b372f801d5f6"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample d61e49254165… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample d61e49254165…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d61e492541652b59d5bef94eb47468086325ac46cf3debcd82fc1578b9396b73"}],["$","meta","4",{"property":"og:title","content":"Sample d61e49254165… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample d61e49254165…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d61e492541652b59d5bef94eb47468086325ac46cf3debcd82fc1578b9396b73"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample d61e49254165… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample d61e49254165…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]